# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 24 02:02:56 host2 sshd[1387047]: Disconnected from invalid user john1 189.217.130.86 port 42474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-24 02:04:42 dovecot_login authenticator failed for H=([85.117.232.42]) [85.117.232.42]:51031: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-24 02:05:04 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:45030: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-24 02:09:24 dovecot_login authenticator failed for H=109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:53388: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-24 02:09:46 dovecot_login authenticator failed for H=(201.173.92.229-clientes-izzi.mx) [201.173.92.229]:57025: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-24 02:10:17 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:53830: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 02:11:05 host2 sshd[1395983]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 02:10:40 host2 pure-ftpd[1395449]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.187
country_id: 2635167
description:
Dec 24 02:12:12 host2 dovecot[1133416]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.187, lip=66.85.158.92, TLS, session=<mzMHlKRGZYZX7LC7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.48
country_id: 2635167
description:
Dec 24 02:12:13 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.48, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1McelKRGd69X7LAw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.68
country_id: 2635167
description:
Dec 24 02:12:47 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.68, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<O08alqRGQ6NX7LBE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.61
country_id: 2635167
description:
Dec 24 02:13:20 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.61, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<4tgVmKRGsYa594k9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 24 02:14:16 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=</cBOm6RGJIDE+2YV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.71
country_id: 2635167
description:
Dec 24 02:14:26 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.71, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=</W4MnKRGl+dX7LBH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.61
country_id: 2635167
description:
Dec 24 02:13:53 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.61, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<mBsRmqRGo+2594k9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 24 02:14:29 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<xK8ZnKRG7MTE+2YY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.61
country_id: 2635167
description:
Dec 24 02:15:00 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.61, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<neMFnqRGMeBX7LA9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.89.218.40
country_id: 6252001
description:
[2025-12-24 02:16:18 +0530] info [cpaneld] 72.89.218.40 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.40
country_id: 2635167
description:
Dec 24 02:16:06 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.40, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<I5r+oaRGPd5X7LAo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.174.218.97
country_id: 6252001
description:
[2025-12-24 02:16:11 +0530] info [cpaneld] 76.174.218.97 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.76.241
country_id: 6252001
description:
[2025-12-24 02:16:15 +0530] info [whostmgrd] 73.93.76.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.162.141.59
country_id: 6252001
description:
[2025-12-24 02:16:13 +0530] info [cpaneld] 68.162.141.59 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.255.75
country_id: 6252001
description:
[2025-12-24 02:16:17 +0530] info [cpaneld] 45.51.255.75 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.46
country_id: 2635167
description:
Dec 24 02:15:33 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.46, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SksDoKRGice594ku>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.98.238.174
country_id: 6252001
description:
[2025-12-24 02:16:11 +0530] info [cpaneld] 74.98.238.174 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.134.218.96
country_id: 6252001
description:
[2025-12-24 02:16:15 +0530] info [cpaneld] 76.134.218.96 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.61
country_id: 2635167
description:
Dec 24 02:17:13 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.61, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<0HzzpaRGy8xX7LA9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.38
country_id: 2635167
description:
Dec 24 02:16:39 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<zhv4o6RGDZBX7LAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Dec 24 02:17:55 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<Wn5XqKRGntjE+2YK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 02:19:11 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56308: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.194
country_id: 3469034
description:
Dec 24 02:20:07 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=138.255.206.194, lip=66.85.158.91, TLS, session=<gCZAr6RG+cmK/87C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.134
country_id: 798544
description:
Dec 24 02:19:39 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=178.216.27.134, lip=66.85.158.91, TLS, session=<T5KvraRGG6qy2BuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.85
country_id: 953987
description:
Dec 24 02:19:46 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=102.129.62.85, lip=66.85.158.91, TLS, session=<tLTcraRG7rlmgT5V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.205
country_id: 798544
description:
Dec 24 02:19:58 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=178.216.29.205, lip=66.85.158.91, TLS, session=<Mu7HrqRGPcCy2B3N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-24 02:22:41 dovecot_login authenticator failed for H=([14.97.77.182]) [14.97.77.182]:41942: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-24 02:23:36 dovecot_login authenticator failed for H=(syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:59375: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 24 02:23:59 host2 sshd[1409049]: Disconnected from invalid user sadmin 151.49.129.67 port 46870 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 24 02:24:23 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=</4p1v6RGNK7E+2YU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.101
country_id: 1819730
description:
Dec 24 02:24:27 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.101, lip=66.85.158.92, TLS, session=<QGrfv6RGTrYtjppl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.101
country_id: 1819730
description:
Dec 24 02:24:29 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.142.154.101, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KLz7v6RGCLotjppl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-24 02:25:15 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:41924: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 24 02:25:36 host2 sshd[1410740]: Disconnected from invalid user junior 151.49.129.67 port 34030 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.109.215.6
country_id: 6252001
description:
[2025-12-24 02:28:01 +0530] info [cpaneld] 208.109.215.6 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.131
country_id: 6252001
description:
Dec 24 02:29:33 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.131, lip=66.85.158.92, session=<UgEV0qRGLM1ChJmD>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.218
country_id: 2635167
description:
Dec 24 02:31:02 host2 dovecot[1133416]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.218, lip=66.85.158.92, TLS, session=<BoZh16RGxc6594na>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Dec 24 02:31:03 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rkNt16RGO9K594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.8
country_id: 2635167
description:
Dec 24 02:31:36 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.8, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6a1o2aRGJ+y594kI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2025-12-24 02:31:36 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:55805: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-24 02:31:57 dovecot_login authenticator failed for H=(186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:32793: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.11
country_id: 2635167
description:
Dec 24 02:32:10 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.11, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<dfZz26RG78xX7LAL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Dec 24 02:32:43 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=</Ilv3aRGk5S594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.9
country_id: 2635167
description:
Dec 24 02:33:17 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.9, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<6sZq36RGTem594kJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.10
country_id: 2635167
description:
Dec 24 02:33:50 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.10, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8i1k4aRG45lX7LAK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.190.24.99
country_id: 3703430
description:
Dec 24 02:34:18 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=185.190.24.99, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oYwN46RGbf65vhhj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.25
country_id: 2635167
description:
Dec 24 02:34:23 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.25, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<o4Bh46RGj5G594kZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.11
country_id: 2635167
description:
Dec 24 02:34:56 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.11, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=</dNc5aRGY8y594kL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.163.200
country_id: 6252001
description:
[2025-12-24 02:35:21 +0530] info [cpaneld] 100.0.163.200 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.107.254.171
country_id: 6252001
description:
[2025-12-24 02:35:26 +0530] info [cpaneld] 24.107.254.171 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.80.121.157
country_id: 6252001
description:
[2025-12-24 02:35:27 +0530] info [cpaneld] 75.80.121.157 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.182.39.35
country_id: 6252001
description:
[2025-12-24 02:35:19 +0530] info [cpaneld] 67.182.39.35 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.88.78.87
country_id: 6252001
description:
[2025-12-24 02:35:22 +0530] info [cpaneld] 73.88.78.87 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.33.228
country_id: 6252001
description:
[2025-12-24 02:35:25 +0530] info [whostmgrd] 98.97.33.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.135.111.240
country_id: 6252001
description:
[2025-12-24 02:35:27 +0530] info [cpaneld] 107.135.111.240 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.4
country_id: 2635167
description:
Dec 24 02:35:30 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.4, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<LipW56RGYc9X7LAE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.13
country_id: 2635167
description:
Dec 24 02:36:03 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.13, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<ZZRR6aRGtYC594kN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 24 02:37:08 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<mZQz7aRGqMPPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.33
country_id: 6252001
description:
Dec 24 02:38:24 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.33, lip=66.85.158.92, session=<AN+58aRGe8LDuEwh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.36
country_id: 6252001
description:
Dec 24 02:38:35 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.36, lip=66.85.158.92, session=<Mr5d8qRGuZPDuEwk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.34
country_id: 6252001
description:
Dec 24 02:38:43 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.34, lip=66.85.158.92, session=</1bf8qRGo7LDuEwi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.245
country_id: 6252001
description:
Dec 24 02:38:46 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.245, lip=66.85.158.92, session=</1QP86RG1YTDuEz1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 24 02:39:09 host2 pure-ftpd[1426357]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.95.72
country_id: 798544
description:
Dec 24 02:39:39 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=78.31.95.72, lip=66.85.158.91, TLS, session=<2vMx9aRGeMZOH19I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.163.8.156
country_id: 798544
description:
Dec 24 02:39:57 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=81.163.8.156, lip=66.85.158.91, TLS, session=<I1ZJ9qRGnuhRowic>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 02:44:23 host2 sshd[1431871]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.23
country_id: 3865483
description:
Dec 24 02:49:00 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.252.23, lip=66.85.158.91, TLS, session=<7yeJFqVGDYezAPwX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.195.158
country_id: 3865483
description:
Dec 24 02:49:21 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=186.96.195.158, lip=66.85.158.91, TLS, session=<gUHKF6VGMdK6YMOe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 24 02:50:24 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<dpyCHKVGqovE+2YT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.62
country_id: 3017382
description:
Dec 24 02:53:26 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.62, lip=66.85.158.92, session=<nHd7J6VG/41b51k+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.178
country_id: 3017382
description:
Dec 24 02:53:09 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.178, lip=66.85.158.92, session=<RsGDJqVGA6tb51my>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.180
country_id: 3017382
description:
Dec 24 02:53:20 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.180, lip=66.85.158.92, session=<HecoJ6VGV41b51m0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.63
country_id: 3017382
description:
Dec 24 02:53:29 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.63, lip=66.85.158.92, session=<bN6tJ6VG+51b51k/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-24 02:54:27 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:48392: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-24 02:54:44 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:43379: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 02:58:24 host2 sshd[1446590]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.154.125
country_id: 6252001
description:
2025-12-24 02:57:53 dovecot_plain authenticator failed for H=server.ynq.bth.mybluehostin.me (localhost) [162.240.154.125]:11248: 535 Incorrect authentication data (set_id=news@ceylondigest.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.93.65.245
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.93.65.245: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.191.203.189
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.191.203.189: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-24 03:06:31 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:57522: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 24 03:09:07 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<T3edX6VGuCdChJmK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 03:12:50 host2 pure-ftpd[1461059]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.231
country_id: 6252001
description:
Dec 24 03:13:22 host2 pure-ftpd[1461844]: (?@38.148.242.231) [INFO] New connection from 38.148.242.231


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 24 03:19:19 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<x23tg6VGgsDE+2YX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 24 03:19:22 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<swIJhKVG4trE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-24 03:20:45 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:49302: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.71
country_id: 6252001
description:
Dec 24 03:21:16 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.71, lip=66.85.158.92, TLS, session=<PiIPi6VGavrG6xhH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-24 03:28:56 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:48404: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-24 03:29:16 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:42466: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.39
country_id: 1643084
description:
2025-12-24 03:31:39 dovecot_login authenticator failed for H=([127.0.0.1]) [157.15.40.39]:49886: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2025-12-24 03:31:29 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.83.15]:45093: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.252.2
country_id: 2921044
description:
Dec 24 03:39:16 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.252.2, lip=66.85.158.92, TLS, session=<U0pvy6VGts+kXPwC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-24 03:43:38 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:52541: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-24 03:44:11 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:43864: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-24 03:47:54 dovecot_login authenticator failed for H=(arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:58314: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-24 03:48:13 dovecot_login authenticator failed for H=([128.185.189.57]) [182.78.79.134]:41304: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.134.152
country_id: 6252001
description:
Dec 24 03:52:20 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.134.152, lip=66.85.158.92, TLS, session=<aXkn+qVGNqalmoaY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-24 04:02:44 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:40295: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 04:04:35 host2 sshd[1522076]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Dec 24 04:04:33 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, session=<aefYJaZG2OvG6xhl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.134.152
country_id: 6252001
description:
Dec 24 04:05:37 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.154.134.152, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JbykKaZGPtOlmoaY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.93.133.101
country_id: 6252001
description:
Dec 24 04:07:04 host2 pure-ftpd[1527222]: (?@35.93.133.101) [INFO] New connection from 35.93.133.101


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 35.92.49.13
country_id: 6252001
description:
Dec 24 04:07:35 host2 dovecot[1133416]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=35.92.49.13, lip=66.85.158.91, session=<ezu1MKZGnIcjXDEN>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.235.223
country_id: 6252001
description:
[2025-12-24 04:07:42 +0530] info [webmaild] 45.147.235.223 - info@melanifinefood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.36.12.8
country_id: 6252001
description:
Dec 24 04:08:38 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.36.12.8, lip=66.85.158.91, session=<2JtyNKZGdtE0JAwI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.233.217.216
country_id: 6252001
description:
[2025-12-24 04:08:57 +0530] info [webmaild] 193.233.217.216 - info@ceylondigest.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.202.7.229
country_id: 6252001
description:
Dec 24 04:09:05 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=54.202.7.229, lip=66.85.158.91, session=<WTILNqZGmM02ygfl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.161.59.224
country_id: 6252001
description:
Dec 24 04:09:24 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 47 secs): user=<>, rip=35.161.59.224, lip=66.85.158.91, session=<oPknN6ZGBosjoTvg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.249.49.30
country_id: 6252001
description:
Dec 24 04:09:40 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.249.49.30, lip=66.85.158.91, session=<yjEnOKZGJL4s+TEe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.219.16.5
country_id: 6252001
description:
Dec 24 04:09:44 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=34.219.16.5, lip=66.85.158.91, session=<7x5ZOKZGcKQi2xAF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.220.195.80
country_id: 2017370
description:
[2025-12-24 04:10:50 +0530] info [webmaild] 77.220.195.80 - info@secondcoffeeinternational.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.88.18.201
country_id: 6252001
description:
Dec 24 04:11:54 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 120 secs): user=<>, rip=52.88.18.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<goMhQKZGDMY0WBLJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.88.18.201
country_id: 6252001
description:
Dec 24 04:12:37 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=52.88.18.201, lip=66.85.158.91, TLS, session=<0MGmQqZGSMs0WBLJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.87.178.137
country_id: 6252001
description:
Dec 24 04:13:08 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=35.87.178.137, lip=66.85.158.91, TLS, session=<keqFRKZGLsUjV7KJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.43.196.4
country_id: 6252001
description:
Dec 24 04:13:11 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=52.43.196.4, lip=66.85.158.91, TLS, session=<6361RKZGTNY0K8QE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-24 04:14:25 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:56462: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-24 04:14:27 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:49715: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-12-24 04:13:46 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:47416: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-24 04:13:59 dovecot_login authenticator failed for H=(50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:32790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-24 04:14:02 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:39193: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.13.126.109
country_id: 6252001
description:
Dec 24 04:14:31 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 120 secs): user=<>, rip=52.13.126.109, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dml5SaZGhLM0DX5t>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 04:15:12 host2 pure-ftpd[1537240]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.27.44.27
country_id: 6252001
description:
Dec 24 04:15:34 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=52.27.44.27, lip=66.85.158.91, TLS, session=<cMg6TaZG5Io0Gywb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.54
country_id: 1643084
description:
Dec 24 04:15:36 host2 sshd[1537711]: Invalid user cloudtourssrilan_travel from 182.8.225.54 port 41395


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.219.16.5
country_id: 6252001
description:
Dec 24 04:15:36 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=34.219.16.5, lip=66.85.158.91, TLS, session=<bkZUTaZGNNEi2xAF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.54
country_id: 1643084
description:
[2025-12-24 04:15:38 +0530] info [whostmgrd] 182.8.225.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.200.203.78
country_id: 6252001
description:
[2025-12-24 04:17:59 +0530] info [whostmgrd] 107.200.203.78 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-24 04:21:53 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:53878: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-24 04:22:21 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:53232: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.209.159.36
country_id: 2921044
description:
Dec 24 04:24:02 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=213.209.159.36, lip=66.85.158.91, session=<HFpqa6ZGHqnV0Z8k>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.10
country_id: 6252001
description:
Dec 24 04:24:49 host2 pure-ftpd[1552076]: (?@147.185.132.10) [INFO] New connection from 147.185.132.10


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.11
country_id: 798549
description:
Dec 24 04:25:36 host2 pure-ftpd[1553167]: (?@85.217.149.11) [INFO] New connection from 85.217.149.11


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.11
country_id: 798549
description:
Dec 24 04:25:46 host2 pure-ftpd[1553428]: (?@85.217.149.11) [INFO] New connection from 85.217.149.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-24 04:29:24 dovecot_login authenticator failed for H=(cm-84.211.13.178.get.no) [84.211.13.178]:37515: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-24 04:29:37 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:45134: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-24 04:37:40 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:33801: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.89
country_id: 6252001
description:
Dec 24 04:45:02 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.89, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6QietqZGSsrN0h9Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-12-24 04:50:45 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:59702: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 04:51:34 host2 sshd[1590515]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-24 04:51:31 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:40020: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 24 04:52:56 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<Lwe50qZGdrbBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-24 04:53:01 dovecot_login authenticator failed for H=([114.9.22.30]) [114.9.22.30]:34762: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 24 05:00:16 host2 sshd[1600502]: Disconnected from invalid user kapsch 152.42.165.179 port 44168 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.137
country_id: 1861060
description:
Dec 24 05:02:06 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=118.194.236.137, lip=66.85.158.92, TLS, session=<6iyp86ZGFqN2wuyJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-12-24 05:02:07 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:46874: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-24 05:02:30 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:58292: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 24 05:02:32 host2 sshd[1602605]: Disconnected from invalid user db-user 51.195.138.37 port 58994 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.137
country_id: 1861060
description:
Dec 24 05:02:35 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=118.194.236.137, lip=66.85.158.92, TLS, session=<gqxk9aZGruh2wuyJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Dec 24 05:02:42 host2 sshd[1602733]: Disconnected from invalid user ammar 212.11.64.162 port 52748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 24 05:03:47 host2 sshd[1604015]: Disconnected from invalid user agotoz 52.237.80.79 port 55180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Dec 24 05:04:26 host2 sshd[1604763]: Disconnected from invalid user deploy 107.174.55.72 port 35118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 24 05:04:58 host2 sshd[1605541]: Disconnected from invalid user userftp 152.42.165.179 port 34172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Dec 24 05:05:05 host2 sshd[1605842]: Disconnected from invalid user test1 107.174.55.72 port 35156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.81.246
country_id: 1835841
description:
Dec 24 05:04:36 host2 sshd[1604941]: Disconnected from invalid user kapsch 43.133.81.246 port 41586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 24 05:04:57 host2 sshd[1605536]: Disconnected from invalid user dnsadmin 51.195.138.37 port 39776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 24 05:05:28 host2 sshd[1606359]: Disconnected from invalid user git 51.195.138.37 port 59330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 24 05:05:34 host2 sshd[1606445]: Disconnected from invalid user supermaint 152.42.165.179 port 49950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Dec 24 05:05:45 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</CO0AKdGf8HG6xil>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 24 05:07:26 host2 sshd[1608049]: Received disconnect from 198.1.117.220 port 41752:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 24 05:06:48 host2 sshd[1607593]: Disconnected from invalid user git 152.42.165.179 port 39712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 24 05:06:55 host2 sshd[1607677]: Disconnected from invalid user agotoz 198.1.117.220 port 57714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Dec 24 05:07:42 host2 sshd[1608288]: Disconnected from invalid user uftp 107.174.55.72 port 42962 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.92
country_id: 6252001
description:
Dec 24 05:08:33 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.92, lip=66.85.158.92, session=<z2C0CqdGGuLG6xhc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.137
country_id: 1861060
description:
Dec 24 05:09:05 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=118.194.236.137, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<MyadDKdGHpJ2wuyJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.55.72
country_id: 6252001
description:
Dec 24 05:09:20 host2 sshd[1609832]: Disconnected from invalid user testuser2 107.174.55.72 port 51828 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.137
country_id: 1861060
description:
Dec 24 05:09:34 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=118.194.236.137, lip=66.85.158.91, TLS, session=<lPZWDqdG9tt2wuyJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.96.37.163
country_id: 2017370
description:
[2025-12-24 05:10:56 +0530] info [webmaild] 185.96.37.163 - info@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 24 05:11:59 host2 sshd[1612025]: Disconnected from invalid user test2 52.237.80.79 port 60162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Dec 24 05:14:54 host2 sshd[1614459]: Disconnected from invalid user pablo 212.11.64.162 port 52602 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 05:17:33 host2 pure-ftpd[1617506]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 24 05:18:35 host2 sshd[1618584]: Disconnected from invalid user pablo 52.237.80.79 port 50764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Dec 24 05:20:01 host2 sshd[1620042]: Disconnected from invalid user user 212.11.64.162 port 36820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 24 05:21:18 host2 sshd[1621269]: Disconnected from invalid user es 101.36.109.176 port 44606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Dec 24 05:22:32 host2 sshd[1622039]: Disconnected from invalid user test2 212.11.64.162 port 50900 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 24 05:22:56 host2 sshd[1622295]: Disconnected from invalid user mary 101.36.109.176 port 48696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 24 05:23:59 host2 sshd[1623070]: Disconnected from invalid user mcadmin 101.36.109.176 port 43266 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 24 05:25:19 host2 sshd[1624125]: Received disconnect from 96.78.175.36 port 44704:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.104.157
country_id: 6252001
description:
Dec 24 05:24:43 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.104.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zY6LRKdGpuesymid>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 24 05:25:47 host2 sshd[1624424]: Disconnected from invalid user scs 96.78.175.36 port 60566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-24 05:26:08 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:45320: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-24 05:26:21 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:50092: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-12-24 05:26:53 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:44027: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.12.22.146
country_id: 6252001
description:
Dec 24 05:28:12 host2 pure-ftpd[1627195]: (?@154.12.22.146) [INFO] New connection from 154.12.22.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 05:28:31 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55733: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2025-12-24 05:29:11 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:35048: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-24 05:29:33 dovecot_login authenticator failed for H=(cm-178.232.80.9.get.no) [178.232.80.9]:50444: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-24 05:31:10 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:52716: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-24 05:34:38 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:43976: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-24 05:35:12 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:58500: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.81.231
country_id: 2921044
description:
Dec 24 05:38:22 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=138.68.81.231, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<FbtWdadGszmKRFHn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.55.191.16
country_id: 3469034
description:
Dec 24 05:38:26 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=201.55.191.16, lip=66.85.158.91, TLS, session=<XzBudKdGpuvJN78Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.43
country_id: 690791
description:
Dec 24 05:38:44 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.1.43, lip=66.85.158.91, TLS, session=<eiStdadGYpewZwEr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.206.154
country_id: 2921044
description:
Dec 24 05:38:58 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.206.154, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tLiAd6dGagguZc6a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.81.231
country_id: 2921044
description:
Dec 24 05:38:29 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 6 secs): user=<>, rip=138.68.81.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<gUfBdadGM0qKRFHn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.88.100.180
country_id: 2017370
description:
[2025-12-24 05:42:23 +0530] info [webmaild] 185.88.100.180 - info@weeratrading.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.177.141
country_id: 1522867
description:
2025-12-24 05:43:24 dovecot_login authenticator failed for H=2.132.177.141.dynamic.telecom.kz ([127.0.0.1]) [2.132.177.141]:48019: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.54.153.56
country_id: 1880251
description:
2025-12-24 05:43:42 dovecot_login authenticator failed for H=([127.0.0.1]) [103.54.153.56]:55420: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.185.26.213
country_id: 953987
description:
Dec 24 05:48:08 host2 sshd[1648279]: Disconnected from invalid user superuser 41.185.26.213 port 49626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.74
country_id: 1733045
description:
2025-12-24 05:49:28 dovecot_login authenticator failed for H=([49.125.201.74]) [49.125.201.74]:58070: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-24 05:49:39 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:59441: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.252
country_id: 1880251
description:
Dec 24 05:52:19 host2 sshd[1652206]: Disconnected from invalid user bitwarden 101.47.143.252 port 57274 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.177.87
country_id: 6252001
description:
Dec 24 05:51:52 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.249.177.87, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LN+bpadGco5K+bFX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-24 06:03:15 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:44350: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-24 06:03:54 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:43510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-24 06:04:24 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:59942: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.252
country_id: 1880251
description:
Dec 24 06:04:36 host2 sshd[1662944]: Disconnected from invalid user testuser 101.47.143.252 port 60566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-12-24 06:04:47 dovecot_login authenticator failed for H=([94.20.234.161]) [94.20.234.161]:41753: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.253.16.118
country_id: 6252001
description:
[2025-12-24 06:10:40 +0530] info [webmaild] 167.253.16.118 - info@kiriaswanu.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.57
country_id: 1643084
description:
[2025-12-24 06:13:30 +0530] info [cpaneld] 185.213.83.57 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.94.206
country_id: 2921044
description:
Dec 24 06:18:28 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.226.94.206, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<Z+C6BKhGGRZA4l7O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.91.215
country_id: 2921044
description:
Dec 24 06:19:03 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=64.226.91.215, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lQLeBqhGxsJA4lvX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.94.206
country_id: 2921044
description:
Dec 24 06:18:34 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 6 secs): user=<>, rip=64.226.94.206, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<GJ4fBahG1QVA4l7O>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 06:19:57 host2 pure-ftpd[1678239]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-24 06:20:34 dovecot_login authenticator failed for H=([209.202.195.148]) [209.202.195.148]:42854: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-24 06:20:48 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:44660: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.88
country_id: 6252001
description:
Dec 24 06:24:23 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.88, lip=66.85.158.92, session=<A/DtGahGCowUQGlY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 24 06:33:59 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<cf5CPKhGno/PWvQO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.88.71.156
country_id: 1819730
description:
Dec 24 06:34:31 host2 pure-ftpd[1692313]: (?@149.88.71.156) [INFO] New connection from 149.88.71.156


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.104
country_id: 6252001
description:
Dec 24 06:34:36 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=20.65.193.104, lip=66.85.158.91, session=<Ceh4PqhG6p4UQcFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.9
country_id: 6252001
description:
Dec 24 06:43:37 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.9, lip=66.85.158.92, session=<Hs65XqhG7tAUQGgJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.158.170.213
country_id: 2139685
description:
2025-12-24 06:54:00 dovecot_login authenticator failed for H=host-175-158-170-213.static.lagoon.nc ([127.0.0.1]) [175.158.170.213]:47700: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 06:55:15 host2 sshd[1709924]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.48.99.20
country_id: 6252001
description:
2025-12-24 06:54:37 dovecot_login authenticator failed for H=([127.0.0.1]) [74.48.99.20]:40460: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.149.79.127
country_id: 6252001
description:
2025-12-24 06:57:17 dovecot_login authenticator failed for H=([127.0.0.1]) [24.149.79.127]:55296: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2025-12-24 06:57:24 dovecot_login authenticator failed for H=([127.0.0.1]) [62.97.173.57]:54052: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.172.78
country_id: 6252001
description:
Dec 24 06:58:20 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.172.78, lip=66.85.158.91, session=<k0VXk6hGKLUofKxO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.251.170
country_id: 3865483
description:
Dec 24 07:08:07 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=179.0.251.170, lip=66.85.158.91, session=<6ShWtqhGot6zAPuq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.85.160
country_id: 3469034
description:
Dec 24 07:08:28 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=200.237.85.160, lip=66.85.158.91, TLS, session=<P4J3tqhG7g7I7VWg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-24 07:08:39 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48794: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.172
country_id: 3865483
description:
Dec 24 07:08:53 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt>, method=PLAIN, rip=179.0.249.172, lip=66.85.158.91, TLS, session=<3dHBt6hGWI+zAPms>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-24 07:09:08 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:45121: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-24 07:15:29 dovecot_login authenticator failed for H=([182.95.176.194]) [182.95.176.194]:58342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-24 07:15:58 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:34296: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.132
country_id: 3469034
description:
Dec 24 07:18:09 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=191.240.36.132, lip=66.85.158.91, TLS, session=<2zoc2ahGPoG/8CSE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.4.48
country_id: 2300660
description:
Dec 24 07:18:29 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.4.48, lip=66.85.158.91, TLS, session=<qkVQ2qhG4LApiwQw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 24 07:20:04 host2 sshd[1729476]: Disconnected from invalid user admin 152.32.129.140 port 10454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.222.206
country_id: 192950
description:
Dec 24 07:20:24 host2 sshd[1729897]: Invalid user secondcoffeeinternational from 41.203.222.206 port 10893


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 24 07:20:42 host2 sshd[1730130]: Disconnected from invalid user ftpuser 152.32.129.140 port 24306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 24 07:21:21 host2 sshd[1730825]: Disconnected from invalid user admin 152.32.129.140 port 38152 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 07:22:29 host2 pure-ftpd[1732031]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.143.137
country_id: 690791
description:
Dec 24 07:22:47 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=37.221.143.137, lip=66.85.158.91, TLS, session=<gxq76ahG4rsl3Y+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.112
country_id: 3175395
description:
Dec 24 07:23:04 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=185.197.8.112, lip=66.85.158.91, TLS, session=</mPR6qhGfbO5xQhw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.139.191.44
country_id: 130758
description:
Dec 24 07:24:10 host2 sshd[1733852]: Disconnected from invalid user ntadmin 94.139.191.44 port 50548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.139.191.44
country_id: 130758
description:
Dec 24 07:25:17 host2 sshd[1735357]: Disconnected from invalid user vnc 94.139.191.44 port 50606 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.141
country_id: 6252001
description:
Dec 24 07:27:14 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.141, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<MdS0+qhG7dWTuYSN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-24 07:31:26 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:49159: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-24 07:32:05 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:43292: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-24 07:32:47 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:49962: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-24 07:32:30 dovecot_login authenticator failed for H=(static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:46260: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-24 07:33:42 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:52510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-24 07:33:48 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:41776: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-24 07:33:55 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:60659: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.14
country_id: 6252001
description:
Dec 24 07:33:58 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.14, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QybAEqlGKs2i2JYO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-24 07:33:30 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:56776: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.14
country_id: 6252001
description:
Dec 24 07:35:07 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=162.216.150.14, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<TT/nFqlGtPGi2JYO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 24 07:39:39 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.210.171, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<DvwRJ6lGXNcjy9Kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 24 07:40:39 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.171, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<fVqqKqlGuuQjy9Kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.14
country_id: 6252001
description:
Dec 24 07:41:17 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.14, lip=66.85.158.92, TLS, session=<jpHzLKlGuPGi2JYO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.16
country_id: 798549
description:
Dec 24 07:41:36 host2 pure-ftpd[1754090]: (?@85.217.140.16) [INFO] New connection from 85.217.140.16


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.140.16
country_id: 798549
description:
Dec 24 07:41:44 host2 pure-ftpd[1754218]: (?@85.217.140.16) [INFO] New connection from 85.217.140.16


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.158.147
country_id: 99237
description:
Dec 24 07:46:20 host2 sshd[1759639]: Disconnected from invalid user webadmin 138.124.158.147 port 41318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Dec 24 07:46:55 host2 sshd[1760106]: Disconnected from invalid user operador 138.124.158.147 port 47222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 24 07:47:09 host2 sshd[1760331]: Disconnected from invalid user rico 92.207.4.157 port 49258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.158.147
country_id: 99237
description:
Dec 24 07:47:28 host2 sshd[1760632]: Disconnected from invalid user admin 138.124.158.147 port 52358 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 24 07:48:25 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.171, lip=66.85.158.91, TLS, session=<hRZqRqlGCP4jy9Kr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 24 07:48:41 host2 sshd[1761727]: Disconnected from invalid user newuser 92.207.4.157 port 52728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 24 07:50:24 host2 sshd[1763766]: Disconnected from invalid user tianhao 92.207.4.157 port 37408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 24 07:53:40 host2 sshd[1767015]: Disconnected from invalid user deploy 198.12.75.220 port 48744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 24 07:55:32 host2 sshd[1769494]: Disconnected from invalid user min 198.12.75.220 port 34822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 24 07:56:09 host2 sshd[1770027]: Disconnected from invalid user alice 198.12.75.220 port 48070 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.183.254.35
country_id: 2017370
description:
[2025-12-24 08:02:32 +0530] info [webmaild] 5.183.254.35 - info@vtradelanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec 24 08:03:33 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<eT+WfKlGruFChJl3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.74.208.138
country_id: 6252001
description:
Dec 24 08:06:01 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.74.208.138, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nZZchalGbJgoStCK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-24 08:06:37 dovecot_login authenticator failed for H=66.68.243.35.bc.googleusercontent.com [35.243.68.66]:53660: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-24 08:06:42 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:43588: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-24 08:06:59 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:41488: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.168
country_id: 2635167
description:
Dec 24 08:08:46 host2 pure-ftpd[1781817]: (?@185.247.137.168) [INFO] New connection from 185.247.137.168


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 08:11:49 host2 sshd[1784822]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.54
country_id: 1643084
description:
Dec 24 08:12:46 host2 sshd[1785803]: Invalid user cloudtourssrilan_travel from 182.8.225.54 port 30962


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.54
country_id: 1643084
description:
[2025-12-24 08:12:48 +0530] info [whostmgrd] 182.8.225.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.217
country_id: 6252001
description:
Dec 24 08:17:00 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.202.117.217, lip=66.85.158.91, TLS, session=<nbCnrKlGEMusynXZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.148
country_id: 3469034
description:
Dec 24 08:17:53 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=191.240.37.148, lip=66.85.158.91, TLS, session=<GL+vrqlGa8W/8CWU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-24 08:18:01 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:35467: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.199
country_id: 3865483
description:
Dec 24 08:18:14 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.190.167.199, lip=66.85.158.91, TLS, session=<6tzyr6lGmaq6vqfH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-24 08:18:59 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:60619: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-24 08:19:33 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:40262: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-24 08:19:14 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:39095: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 08:22:37 host2 sshd[1795537]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.97.131
country_id: 6290252
description:
Dec 24 08:22:11 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=109.206.97.131, lip=66.85.158.91, TLS, session=<5IE8vqlGjrxtzmGD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.208
country_id: 3175395
description:
Dec 24 08:22:29 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=171.22.233.208, lip=66.85.158.91, TLS, session=<qvxJv6lGqserFunQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 08:25:00 host2 pure-ftpd[1797696]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-24 08:26:15 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:51570: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-24 08:26:43 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:42469: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Dec 24 08:30:59 host2 sshd[1803538]: Disconnected from invalid user ubuntu 41.216.177.55 port 45590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.143.34
country_id: 1819730
description:
Dec 24 08:30:39 host2 sshd[1803316]: Disconnected from invalid user emily 124.156.143.34 port 50704 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.156.143.34
country_id: 1819730
description:
Dec 24 08:31:19 host2 sshd[1803826]: Disconnected from invalid user dev 124.156.143.34 port 35510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Dec 24 08:32:33 host2 sshd[1804738]: Disconnected from invalid user mbp 118.26.36.241 port 46280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 24 08:32:34 host2 sshd[1804753]: Disconnected from invalid user emily 79.168.139.28 port 48314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Dec 24 08:33:10 host2 sshd[1805267]: Disconnected from invalid user uno 118.26.36.241 port 44656 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 24 08:33:38 host2 sshd[1805658]: Disconnected from invalid user ansible 79.168.139.28 port 46164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.143.34
country_id: 1819730
description:
Dec 24 08:34:31 host2 sshd[1806439]: Disconnected from invalid user jin 124.156.143.34 port 44250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 24 08:36:10 host2 sshd[1808557]: Disconnected from invalid user zhy 79.168.139.28 port 59026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.177.55
country_id: 1643084
description:
Dec 24 08:36:43 host2 sshd[1809170]: Disconnected from invalid user liuyong 41.216.177.55 port 41366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-24 08:38:13 dovecot_login authenticator failed for H=([45.194.26.149]) [45.194.26.149]:43137: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 08:40:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55151: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-12-24 08:41:10 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:59986: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.184.94.75
country_id: 2328926
description:
2025-12-24 08:41:40 dovecot_login authenticator failed for H=41-184-94-75.rv.ipnxtelecoms.com ([102.164.35.116]) [41.184.94.75]:57890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.170.21.223
country_id: 6252001
description:
2025-12-24 08:41:54 dovecot_login authenticator failed for H=(75-170-21-223.rcmt.centurylink.net) [75.170.21.223]:45240: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
country_id: 3469034
description:
2025-12-24 08:42:21 dovecot_login authenticator failed for H=(177-174-89-105.user.vivozap.com.br) [177.174.89.99]:46367: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-24 08:42:36 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:59628: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 24 08:49:10 host2 dovecot[1133416]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS, session=<8PmsH6pGUODPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 24 08:49:10 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<WWezH6pGVODPWvQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.232.62.166
country_id: 3469034
description:
Dec 24 08:58:00 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=168.232.62.166, lip=66.85.158.91, TLS, session=<6RY4PqpGCbCo6D6m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-24 08:58:15 dovecot_login authenticator failed for H=([178.150.135.19]) [178.150.135.19]:36890: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.0.248.88
country_id: 3469034
description:
Dec 24 08:58:19 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=131.0.248.88, lip=66.85.158.91, TLS, session=<vu9mP6pGvrCDAPhY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-24 08:58:58 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:58174: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 24 09:01:41 host2 sshd[1841807]: Disconnected from invalid user thomas 45.230.150.7 port 43404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-12-24 09:02:46 dovecot_login authenticator failed for H=([203.172.213.166]) [203.172.213.166]:42824: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-24 09:02:59 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:51640: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Dec 24 09:04:44 host2 sshd[1845166]: Disconnected from invalid user joaquin 95.39.201.205 port 56940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 24 09:05:50 host2 sshd[1846619]: Disconnected from invalid user postgres 38.19.156.18 port 53170 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 24 09:06:23 host2 sshd[1847352]: Disconnected from invalid user username 45.230.150.7 port 34886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 24 09:07:35 host2 sshd[1848620]: Disconnected from invalid user dev 45.230.150.7 port 59176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 24 09:07:40 host2 sshd[1848704]: Disconnected from invalid user wordpress 38.19.156.18 port 60840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Dec 24 09:07:55 host2 sshd[1848983]: Disconnected from invalid user username 104.168.35.231 port 53186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 24 09:08:56 host2 sshd[1849861]: Disconnected from invalid user minecraft 38.19.156.18 port 56542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Dec 24 09:09:31 host2 sshd[1850408]: Disconnected from invalid user thomas 104.168.35.231 port 55948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 24 09:10:08 host2 sshd[1851067]: Disconnected from invalid user oracle 38.19.156.18 port 52230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Dec 24 09:09:10 host2 sshd[1850098]: Disconnected from invalid user nikita 95.39.201.205 port 53598 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.49.64
country_id: 6252001
description:
[2025-12-24 09:10:22 +0530] info [cpaneld] 45.3.49.64 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.225.97.41
country_id: 2921044
description:
Dec 24 09:11:07 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.225.97.41, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<XJYwbqpGiVdA4WEp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Dec 24 09:12:08 host2 sshd[1852911]: Disconnected from invalid user postgres 104.168.35.231 port 60968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.225.97.41
country_id: 2921044
description:
Dec 24 09:11:14 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 6 secs): user=<>, rip=64.225.97.41, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<owGabqpG72lA4WEp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.121.160
country_id: 2921044
description:
Dec 24 09:11:51 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.121.160, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4k3ZcKpG7o+d5nmg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.96
country_id: 2264397
description:
Dec 24 09:13:13 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.156.128.96, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<TjG7dapG1MMtnIBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.97
country_id: 2264397
description:
Dec 24 09:13:15 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.128.97, lip=66.85.158.92, TLS, session=<VQHVdapG4YgtnIBh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.98
country_id: 2264397
description:
Dec 24 09:13:17 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.98, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ghvsdapGd9otnIBi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.99
country_id: 2264397
description:
Dec 24 09:13:21 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.128.99, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<f0UqdqpGP8stnIBj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.35.231
country_id: 6252001
description:
Dec 24 09:13:40 host2 sshd[1854605]: Disconnected from invalid user deploy 104.168.35.231 port 59804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Dec 24 09:14:38 host2 sshd[1855530]: Disconnected from invalid user work 95.39.201.205 port 42508 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.169.247
country_id: 6252001
description:
[2025-12-24 09:14:49 +0530] info [webmaild] 140.235.169.247 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-24 09:18:13 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:48190: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 24 09:22:19 host2 sshd[1862671]: Disconnected from invalid user confluence 107.175.159.248 port 48752 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.183.27
country_id: 6252001
description:
Dec 24 09:23:46 host2 pure-ftpd[1864241]: (?@152.32.183.27) [INFO] New connection from 152.32.183.27


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 24 09:24:11 host2 sshd[1864620]: Disconnected from invalid user user2 107.175.159.248 port 48810 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 09:27:31 host2 pure-ftpd[1868750]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.159
country_id: 6252001
description:
Dec 24 09:28:40 host2 pure-ftpd[1869943]: (?@20.65.193.159) [INFO] New connection from 20.65.193.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2025-12-24 09:30:14 dovecot_login authenticator failed for H=([49.124.151.14]) [49.124.151.14]:45610: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-24 09:30:57 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:39416: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 24 09:33:08 host2 sshd[1874876]: Disconnected from invalid user gmodserver 107.175.159.248 port 49118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-24 09:32:26 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:39178: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.22.91.68
country_id: 3175395
description:
[2025-12-24 09:33:35 +0530] info [cpaneld] 149.22.91.68 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.17.41.25
country_id: 6252001
description:
[2025-12-24 09:33:52 +0530] info [webmaild] 84.17.41.25 - marketing@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.54
country_id: 2264397
description:
Dec 24 09:37:06 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=109.105.210.54, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<r1Ijy6pGI+NtadI2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.55
country_id: 2264397
description:
Dec 24 09:37:11 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.210.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=</WFqy6pGne1tadI3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.210.55
country_id: 2264397
description:
Dec 24 09:36:58 host2 dovecot[1133416]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.55, lip=66.85.158.91, TLS, session=<vyWqyqpGl9ptadI3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.52
country_id: 2264397
description:
Dec 24 09:37:02 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.52, lip=66.85.158.91, TLS, session=<YQHfyqpGRNBtadI0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.53
country_id: 2264397
description:
Dec 24 09:37:04 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.210.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<LjYFy6pGA8htadI1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.51
country_id: 1269750
description:
Dec 24 09:38:54 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=43.229.225.51, lip=66.85.158.91, TLS, session=<lYZw0KpGcL4r5eEz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.36.202.204
country_id: 3469034
description:
Dec 24 09:39:04 host2 dovecot[1133416]: imap-login: Disconnected: Shutting down (auth process communication failure): user=<gihan>, method=LOGIN, rip=138.36.202.204, lip=66.85.158.91, session=<szGr0apG2uKKJMrM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.159.20.88
country_id: 6252001
description:
[2025-12-24 09:41:27 +0530] info [webmaild] 45.159.20.88 - info@colourmarklabels.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2025-12-24 09:43:29 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.214.212]:53912: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-12-24 09:45:02 dovecot_login authenticator failed for H=(190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:34476: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.219.9
country_id: 3865483
description:
Dec 24 09:46:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=186.1.219.9, lip=66.85.158.91, TLS, session=<32sG7KpG4rm6AdsJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.87.46
country_id: 3469034
description:
Dec 24 09:46:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=201.159.87.46, lip=66.85.158.91, TLS, session=<Uu497apGGZzJn1cu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.210.106
country_id: 1819730
description:
Dec 24 09:50:05 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=123.58.210.106, lip=66.85.158.91, session=<1bSH+apGqJJ7OtJq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.210.106
country_id: 1819730
description:
Dec 24 09:50:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=123.58.210.106, lip=66.85.158.91, session=<5jCi+qpGtJJ7OtJq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.130.79
country_id: 2077456
description:
2025-12-24 09:50:56 dovecot_login authenticator failed for H=(61-69-130-79.static.tpgi.com.au) [61.69.130.79]:54594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-24 09:51:27 dovecot_login authenticator failed for H=([189.109.48.81]) [189.56.202.86]:41432: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.210.106
country_id: 1819730
description:
Dec 24 09:52:13 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=123.58.210.106, lip=66.85.158.92, session=<d+AvAatGkot7OtJq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 09:55:54 host2 sshd[1903843]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-12-24 09:57:17 dovecot_login authenticator failed for H=5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:38562: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-24 09:57:25 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:47981: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-24 09:57:40 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:43384: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.11.179.18
country_id: 953987
description:
2025-12-24 09:58:37 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [196.11.179.18]:52557: 535 Incorrect authentication data (set_id=charana.wijesiri@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.75
country_id: 2328926
description:
Dec 24 10:00:20 host2 pure-ftpd[1907694]: (?@102.204.223.75) [INFO] New connection from 102.204.223.75


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-24 10:03:20 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:56748: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 10:06:42 host2 sshd[1914205]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-24 10:09:53 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:54490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-24 10:10:26 dovecot_login authenticator failed for H=([65.20.136.183]) [65.20.136.183]:38679: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.76.96
country_id: 6252001
description:
[2025-12-24 10:12:48 +0530] info [cpaneld] 99.66.76.96 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.113.231
country_id: 6252001
description:
[2025-12-24 10:12:49 +0530] info [cpaneld] 73.15.113.231 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.167.141
country_id: 6252001
description:
[2025-12-24 10:12:50 +0530] info [cpaneld] 23.242.167.141 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.127.149.81
country_id: 6252001
description:
[2025-12-24 10:12:51 +0530] info [whostmgrd] 76.127.149.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.159.130.57
country_id: 6252001
description:
[2025-12-24 10:12:52 +0530] info [cpaneld] 47.159.130.57 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.189.59.120
country_id: 6252001
description:
[2025-12-24 10:12:53 +0530] info [cpaneld] 67.189.59.120 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.83.188.112
country_id: 6252001
description:
[2025-12-24 10:12:55 +0530] info [cpaneld] 72.83.188.112 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.250.151
country_id: 6252001
description:
Dec 24 10:13:50 host2 pure-ftpd[1922400]: (?@172.174.250.151) [INFO] New connection from 172.174.250.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.81.211.199
country_id: 6252001
description:
[2025-12-24 10:14:42 +0530] info [cpaneld] 75.81.211.199 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.22.171.207
country_id: 6252001
description:
[2025-12-24 10:14:45 +0530] info [cpaneld] 76.22.171.207 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.225.124
country_id: 6252001
description:
[2025-12-24 10:14:43 +0530] info [cpaneld] 35.149.225.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.174.33.20
country_id: 6252001
description:
[2025-12-24 10:14:46 +0530] info [whostmgrd] 104.174.33.20 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.94.76.158
country_id: 6252001
description:
[2025-12-24 10:14:48 +0530] info [cpaneld] 70.94.76.158 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.41.212.234
country_id: 6252001
description:
[2025-12-24 10:14:50 +0530] info [cpaneld] 66.41.212.234 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.212.154.47
country_id: 6252001
description:
[2025-12-24 10:14:52 +0530] info [cpaneld] 71.212.154.47 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-24 10:16:06 dovecot_login authenticator failed for H=(pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:56294: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.129.128.154
country_id: 6252001
description:
[2025-12-24 10:16:52 +0530] info [whostmgrd] 75.129.128.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.135.78.101
country_id: 6252001
description:
[2025-12-24 10:16:54 +0530] info [cpaneld] 135.135.78.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.179.177.156
country_id: 6252001
description:
[2025-12-24 10:16:55 +0530] info [cpaneld] 71.179.177.156 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.175.130.53
country_id: 6252001
description:
[2025-12-24 10:16:58 +0530] info [cpaneld] 70.175.130.53 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.251.71.225
country_id: 6252001
description:
[2025-12-24 10:16:47 +0530] info [cpaneld] 75.251.71.225 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.61.44.84
country_id: 6252001
description:
[2025-12-24 10:16:49 +0530] info [cpaneld] 66.61.44.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-12-24 10:16:24 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:34408: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.111.244.2
country_id: 6252001
description:
[2025-12-24 10:16:50 +0530] info [cpaneld] 71.111.244.2 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-24 10:19:18 dovecot_login authenticator failed for H=([125.19.165.242]) [125.19.188.98]:40256: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-24 10:20:10 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:35113: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.177
country_id: 2264397
description:
Dec 24 10:21:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.177, lip=66.85.158.91, session=<AsYqaKtG9+QtnIGx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-24 10:20:28 dovecot_login authenticator failed for H=(cm-84.211.11.216.get.no) [84.211.11.216]:45426: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-24 10:20:53 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:43404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-24 10:25:56 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:47100: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-24 10:26:07 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:54826: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-24 10:25:31 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:55006: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 24 10:25:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<eJLpeKtGOK/BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-24 10:29:56 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:50884: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 10:30:02 host2 pure-ftpd[1936691]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-24 10:30:12 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:59732: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.12.230
country_id: 2300660
description:
Dec 24 10:30:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=41.139.12.230, lip=66.85.158.91, TLS, session=<ODU5iatGTLcpiwzm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.252.229.77
country_id: 3865483
description:
Dec 24 10:30:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=201.252.229.77, lip=66.85.158.91, TLS, session=<KBPxh6tG2pPJ/OVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.172
country_id: 6252001
description:
Dec 24 10:34:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.172, lip=66.85.158.92, session=<7XSrmatG69RAPsWs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.167
country_id: 6252001
description:
Dec 24 10:35:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.167, lip=66.85.158.92, TLS: Connection closed, session=<Mw5RmqtGht5APsWn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.167
country_id: 6252001
description:
Dec 24 10:35:14 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.167, lip=66.85.158.92, session=</TIDm6tGWNBAPsWn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.179.131.59
country_id: 6252001
description:
[2025-12-24 10:36:28 +0530] info [cpaneld] 97.179.131.59 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.82.199.137
country_id: 6252001
description:
[2025-12-24 10:36:31 +0530] info [cpaneld] 99.82.199.137 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.186.239.91
country_id: 6252001
description:
[2025-12-24 10:36:29 +0530] info [cpaneld] 47.186.239.91 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.193.48.209
country_id: 6252001
description:
[2025-12-24 10:36:33 +0530] info [cpaneld] 47.193.48.209 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.249.154.224
country_id: 6252001
description:
[2025-12-24 10:36:32 +0530] info [whostmgrd] 76.249.154.224 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.3.89.5
country_id: 6252001
description:
[2025-12-24 10:36:34 +0530] info [cpaneld] 68.3.89.5 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.152.19
country_id: 6252001
description:
[2025-12-24 10:36:35 +0530] info [cpaneld] 73.92.152.19 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.187.113.78
country_id: 6252001
description:
[2025-12-24 10:40:10 +0530] info [cpaneld] 73.187.113.78 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.0.48.132
country_id: 6252001
description:
[2025-12-24 10:40:11 +0530] info [cpaneld] 98.0.48.132 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.203.14.130
country_id: 6252001
description:
[2025-12-24 10:40:13 +0530] info [whostmgrd] 76.203.14.130 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.180
country_id: 6252001
description:
Dec 24 10:40:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.180, lip=66.85.158.91, TLS, session=<LKdMrKtGsvnN0h+0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.211.113.230
country_id: 6252001
description:
[2025-12-24 10:40:09 +0530] info [cpaneld] 64.211.113.230 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.57.211.102
country_id: 6252001
description:
[2025-12-24 10:40:20 +0530] info [cpaneld] 136.57.211.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.80.189
country_id: 6252001
description:
[2025-12-24 10:40:20 +0530] info [cpaneld] 47.149.80.189 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.118.91.243
country_id: 6252001
description:
[2025-12-24 10:40:26 +0530] info [cpaneld] 98.118.91.243 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.1.85.89
country_id: 6252001
description:
[2025-12-24 10:40:22 +0530] info [cpaneld] 24.1.85.89 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.18.137.223
country_id: 6252001
description:
[2025-12-24 10:40:24 +0530] info [cpaneld] 108.18.137.223 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.179.141.251
country_id: 6252001
description:
[2025-12-24 10:40:27 +0530] info [cpaneld] 75.179.141.251 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.75.238.83
country_id: 6252001
description:
[2025-12-24 10:40:16 +0530] info [cpaneld] 149.75.238.83 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.139.179.239
country_id: 6252001
description:
[2025-12-24 10:40:19 +0530] info [cpaneld] 97.139.179.239 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.188.200.112
country_id: 6252001
description:
[2025-12-24 10:40:18 +0530] info [cpaneld] 64.188.200.112 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.168.170.7
country_id: 6252001
description:
[2025-12-24 10:40:23 +0530] info [whostmgrd] 98.168.170.7 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.180.53.59
country_id: 6252001
description:
[2025-12-24 10:46:58 +0530] info [whostmgrd] 174.180.53.59 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.7.139.111
country_id: 6252001
description:
[2025-12-24 10:46:59 +0530] info [cpaneld] 47.7.139.111 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.138.118.148
country_id: 6252001
description:
[2025-12-24 10:47:00 +0530] info [cpaneld] 107.138.118.148 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.172.138.63
country_id: 6252001
description:
[2025-12-24 10:47:02 +0530] info [cpaneld] 104.172.138.63 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.131.170.118
country_id: 6252001
description:
[2025-12-24 10:46:52 +0530] info [cpaneld] 70.131.170.118 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.76.245.72
country_id: 6252001
description:
[2025-12-24 10:46:55 +0530] info [cpaneld] 108.76.245.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.34.3
country_id: 6252001
description:
[2025-12-24 10:46:57 +0530] info [cpaneld] 35.144.34.3 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.12.22.146
country_id: 6252001
description:
Dec 24 10:47:29 host2 pure-ftpd[1953674]: (?@154.12.22.146) [INFO] New connection from 154.12.22.146


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 24 10:47:43 host2 sshd[1953833]: Disconnected from invalid user frappe 179.40.112.10 port 47102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Dec 24 10:48:44 host2 sshd[1954733]: Disconnected from invalid user pwserver 103.72.147.99 port 38428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 24 10:49:27 host2 sshd[1955311]: Disconnected from invalid user test2 187.140.184.163 port 42840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 24 10:50:47 host2 sshd[1956627]: Disconnected from invalid user admin 187.140.184.163 port 45684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.114.78
country_id: 3017382
description:
Dec 24 10:51:04 host2 sshd[1957179]: Disconnected from invalid user adminuser 51.178.114.78 port 43184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 24 10:50:47 host2 sshd[1956591]: Disconnected from invalid user sally 179.40.112.10 port 44650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 24 10:51:56 host2 sshd[1957850]: Disconnected from invalid user tes 187.140.184.163 port 58356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-24 10:52:12 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:54856: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 24 10:52:29 host2 sshd[1958259]: Disconnected from invalid user deploy 187.140.184.163 port 42006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 24 10:52:50 host2 sshd[1958537]: Disconnected from invalid user newuser 36.89.28.139 port 38824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.217
country_id: 1819730
description:
Dec 24 10:53:13 host2 sshd[1958845]: Disconnected from invalid user git 152.32.135.217 port 55932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 24 10:53:31 host2 sshd[1959059]: Disconnected from invalid user david 179.40.112.10 port 41934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-12-24 10:54:47 dovecot_login authenticator failed for H=([65.20.171.116]) [65.20.171.116]:52572: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 24 10:54:59 host2 sshd[1960706]: Disconnected from invalid user farm 36.89.28.139 port 38944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.217
country_id: 1819730
description:
Dec 24 10:54:30 host2 sshd[1960301]: Disconnected from invalid user adminuser 152.32.135.217 port 37762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Dec 24 10:54:39 host2 sshd[1960406]: Disconnected from invalid user myvpn 103.72.147.99 port 38874 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.114.78
country_id: 3017382
description:
Dec 24 10:56:13 host2 sshd[1962047]: Disconnected from invalid user ubuntu 51.178.114.78 port 49124 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-24 10:55:17 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:40462: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Dec 24 10:55:18 host2 sshd[1961133]: Disconnected from invalid user admin 103.72.147.99 port 58438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 24 10:57:39 host2 sshd[1963168]: Disconnected from invalid user temp 36.89.28.139 port 36062 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-24 11:00:27 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:56622: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.23.199.3
country_id: 2921044
description:
Dec 24 11:05:56 host2 sshd[1971069]: Disconnected from invalid user xh 193.23.199.3 port 33846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.62.227
country_id: 1668284
description:
Dec 24 11:05:37 host2 sshd[1970832]: Disconnected from invalid user ubuntu 118.193.62.227 port 46996 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.44.215.169
country_id: 6252001
description:
[2025-12-24 11:07:08 +0530] info [cpaneld] 73.44.215.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.100.189
country_id: 6252001
description:
[2025-12-24 11:07:11 +0530] info [cpaneld] 73.66.100.189 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.62.227
country_id: 1668284
description:
Dec 24 11:06:19 host2 sshd[1971814]: Disconnected from invalid user www-data 118.193.62.227 port 33946 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.173.166
country_id: 6252001
description:
[2025-12-24 11:07:10 +0530] info [cpaneld] 172.59.173.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.153.55.13
country_id: 6252001
description:
[2025-12-24 11:07:14 +0530] info [whostmgrd] 164.153.55.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.134.18.118
country_id: 6252001
description:
[2025-12-24 11:07:18 +0530] info [cpaneld] 135.134.18.118 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.112.81.196
country_id: 6252001
description:
[2025-12-24 11:07:16 +0530] info [cpaneld] 70.112.81.196 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.72.102
country_id: 6252001
description:
[2025-12-24 11:07:20 +0530] info [cpaneld] 76.33.72.102 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.62.227
country_id: 1668284
description:
Dec 24 11:09:06 host2 sshd[1973978]: Disconnected from invalid user ubuntu 118.193.62.227 port 59134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 24 11:09:07 host2 sshd[1974006]: Disconnected from invalid user vikas 139.59.188.13 port 48874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Dec 24 11:09:23 host2 sshd[1974187]: Disconnected from invalid user git 45.78.201.248 port 34090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.3
country_id: 2921044
description:
Dec 24 11:09:26 host2 sshd[1974174]: Disconnected from invalid user temp 193.23.199.3 port 60618 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 24 11:10:08 host2 sshd[1974979]: Received disconnect from 139.59.188.13 port 48136:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 24 11:10:36 host2 sshd[1975436]: Disconnected from invalid user amule 139.59.188.13 port 33648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.62.227
country_id: 1668284
description:
Dec 24 11:10:23 host2 sshd[1975250]: Disconnected from invalid user VPN 118.193.62.227 port 53112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:15:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<s97ZKaxGoOoDiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.63.30.161
country_id: 6252001
description:
[2025-12-24 11:15:10 +0530] info [cpaneld] 73.63.30.161 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.206.234.205
country_id: 6252001
description:
[2025-12-24 11:15:13 +0530] info [cpaneld] 107.206.234.205 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.7.93.190
country_id: 6252001
description:
[2025-12-24 11:15:12 +0530] info [cpaneld] 100.7.93.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.77.79.75
country_id: 6252001
description:
[2025-12-24 11:15:17 +0530] info [whostmgrd] 108.77.79.75 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.126.88.120
country_id: 6252001
description:
[2025-12-24 11:15:18 +0530] info [cpaneld] 141.126.88.120 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.106.245.116
country_id: 6252001
description:
[2025-12-24 11:15:20 +0530] info [cpaneld] 68.106.245.116 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.90.21.142
country_id: 6252001
description:
[2025-12-24 11:15:21 +0530] info [cpaneld] 97.90.21.142 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:16:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5HFFLqxGdsIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:17:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bO+3MaxG1pYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:18:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<FymzNKxGBoEDiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.208.161.98
country_id: 6252001
description:
[2025-12-24 11:19:44 +0530] info [cpaneld] 72.208.161.98 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.46.21.6
country_id: 6252001
description:
[2025-12-24 11:19:43 +0530] info [cpaneld] 76.46.21.6 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.139.67.226
country_id: 6252001
description:
[2025-12-24 11:19:38 +0530] info [cpaneld] 35.139.67.226 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.179.178.247
country_id: 6252001
description:
[2025-12-24 11:19:37 +0530] info [cpaneld] 73.179.178.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.102.228.66
country_id: 6252001
description:
[2025-12-24 11:19:40 +0530] info [whostmgrd] 99.102.228.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:19:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<CYM9OaxGbrkDiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.139.162.84
country_id: 6252001
description:
[2025-12-24 11:19:36 +0530] info [cpaneld] 107.139.162.84 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.186.73
country_id: 6252001
description:
[2025-12-24 11:19:42 +0530] info [cpaneld] 172.59.186.73 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:20:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jHTcPKxGQtUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:21:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<RPQGQaxGxuwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:22:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<A2HCRKxGEMcDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:23:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<khQiSKxGXLADiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2025-12-24 11:24:11 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:40067: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-12-24 11:24:33 dovecot_login authenticator failed for H=([196.216.220.210]) [196.216.220.210]:45536: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 24 11:24:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<bHrwS6xGVogDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 11:32:27 host2 pure-ftpd[1995068]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.189.23
country_id: 6252001
description:
[2025-12-24 11:36:25 +0530] info [cpaneld] 76.32.189.23 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.187.102
country_id: 6252001
description:
[2025-12-24 11:36:31 +0530] info [cpaneld] 172.59.187.102 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Dec 24 11:36:50 host2 sshd[1998734]: Disconnected from invalid user sc 144.48.8.10 port 35260 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.91.108.170
country_id: 6252001
description:
[2025-12-24 11:36:26 +0530] info [cpaneld] 172.91.108.170 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.116.190.151
country_id: 6252001
description:
[2025-12-24 11:36:27 +0530] info [cpaneld] 99.116.190.151 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.34.131.12
country_id: 6252001
description:
[2025-12-24 11:36:29 +0530] info [whostmgrd] 104.34.131.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.115.103.108
country_id: 6252001
description:
[2025-12-24 11:36:32 +0530] info [cpaneld] 23.115.103.108 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.237.201.87
country_id: 6252001
description:
[2025-12-24 11:36:34 +0530] info [cpaneld] 71.237.201.87 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.8.10
country_id: 1861060
description:
Dec 24 11:38:07 host2 sshd[2000043]: Disconnected from invalid user ubuntu 144.48.8.10 port 58754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Dec 24 11:38:39 host2 sshd[2000492]: Disconnected from invalid user git 144.48.8.10 port 42202 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.253.16.168
country_id: 6252001
description:
[2025-12-24 11:39:06 +0530] info [webmaild] 167.253.16.168 - info@sysnytech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Dec 24 11:39:13 host2 sshd[2000919]: Disconnected from invalid user mp 144.48.8.10 port 53878 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 11:40:58 host2 sshd[2002471]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.63
country_id: 3996063
description:
2025-12-24 11:42:59 dovecot_login authenticator failed for H=(189.219.138.63-clientes-izzi.mx) [189.219.138.63]:47299: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 24 11:43:56 host2 sshd[2004588]: Disconnected from invalid user alpha 129.80.134.10 port 41362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.171.78.70
country_id: 3686110
description:
Dec 24 11:46:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=190.171.78.70, lip=66.85.158.91, TLS, session=<H3QOl6xGaMm+q05G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.80.134.10
country_id: 6252001
description:
Dec 24 11:45:46 host2 sshd[2006279]: Disconnected from invalid user splunk 129.80.134.10 port 48986 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.245.13.234
country_id: 1269750
description:
Dec 24 11:46:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=43.245.13.234, lip=66.85.158.91, TLS, session=<apA/mKxG4J4r9Q3q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.35
country_id: 3865483
description:
Dec 24 11:50:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.251.35, lip=66.85.158.91, TLS, session=<Ofqzp6xGIIuzAPsj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.94.24.212
country_id: 3469034
description:
Dec 24 11:51:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=187.94.24.212, lip=66.85.158.91, TLS, session=<nxgbqaxGFoO7XhjU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 11:51:53 host2 sshd[2012265]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 11:51:28 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54579: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.164.28.55
country_id: 6252001
description:
[2025-12-24 11:53:57 +0530] info [whostmgrd] 66.164.28.55 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.73.29
country_id: 6252001
description:
[2025-12-24 11:54:00 +0530] info [cpaneld] 76.38.73.29 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.110.36
country_id: 6252001
description:
[2025-12-24 11:53:59 +0530] info [cpaneld] 76.33.110.36 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.3.2.74
country_id: 6252001
description:
[2025-12-24 11:54:01 +0530] info [cpaneld] 73.3.2.74 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.51.30.126
country_id: 6252001
description:
[2025-12-24 11:53:53 +0530] info [cpaneld] 73.51.30.126 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.17.7.35
country_id: 6252001
description:
[2025-12-24 11:53:54 +0530] info [cpaneld] 100.17.7.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.141.188.185
country_id: 6252001
description:
[2025-12-24 11:53:56 +0530] info [cpaneld] 73.141.188.185 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-24 11:59:22 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:55874: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-12-24 12:00:29 dovecot_login authenticator failed for H=(techday.com.ua) [46.149.83.62]:56772: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-24 11:59:37 dovecot_login authenticator failed for H=(187.161.173.2-clientes-izzi.mx) [187.161.173.2]:46967: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-24 12:01:12 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:34329: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.58.206
country_id: 6252001
description:
[2025-12-24 12:02:52 +0530] info [cpaneld] 47.150.58.206 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.83.194.66
country_id: 6252001
description:
[2025-12-24 12:02:53 +0530] info [cpaneld] 184.83.194.66 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.213.175.175
country_id: 6252001
description:
[2025-12-24 12:02:55 +0530] info [cpaneld] 98.213.175.175 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.226.81.219
country_id: 6252001
description:
[2025-12-24 12:02:56 +0530] info [whostmgrd] 76.226.81.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.218.220.42
country_id: 6252001
description:
[2025-12-24 12:02:58 +0530] info [cpaneld] 107.218.220.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.174.27.39
country_id: 6252001
description:
[2025-12-24 12:03:01 +0530] info [cpaneld] 75.174.27.39 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.98.34
country_id: 6252001
description:
[2025-12-24 12:03:00 +0530] info [cpaneld] 73.235.98.34 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.198.166.15
country_id: 6252001
description:
[2025-12-24 12:06:58 +0530] info [whostmgrd] 107.198.166.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.79.208.240
country_id: 6252001
description:
[2025-12-24 12:07:00 +0530] info [cpaneld] 209.79.208.240 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.75.200.26
country_id: 6252001
description:
[2025-12-24 12:06:59 +0530] info [cpaneld] 149.75.200.26 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.248.124
country_id: 6252001
description:
[2025-12-24 12:07:02 +0530] info [cpaneld] 50.5.248.124 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.106.249.208
country_id: 6252001
description:
[2025-12-24 12:06:54 +0530] info [cpaneld] 216.106.249.208 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.144.29.84
country_id: 6252001
description:
[2025-12-24 12:06:56 +0530] info [cpaneld] 47.144.29.84 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.120.82
country_id: 6252001
description:
[2025-12-24 12:06:55 +0530] info [cpaneld] 172.56.120.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 24 12:12:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4Xmr9qxGtvxChJmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.185
country_id: 3996063
description:
2025-12-24 12:14:11 dovecot_login authenticator failed for H=([177.236.145.185]) [177.236.145.185]:57360: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-24 12:14:54 dovecot_login authenticator failed for H=([213.230.65.53]) [213.230.65.53]:34898: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 24 12:15:49 host2 sshd[2033645]: Disconnected from invalid user financeiro 27.254.137.144 port 44302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 24 12:17:55 host2 sshd[2035383]: Disconnected from invalid user vicente 27.254.137.144 port 45072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 24 12:18:36 host2 sshd[2035840]: Disconnected from invalid user user 27.254.137.144 port 40894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 24 12:19:54 host2 sshd[2036573]: Disconnected from invalid user zimbra 27.254.137.144 port 60798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-24 12:20:15 dovecot_login authenticator failed for H=109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:39964: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-24 12:20:46 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:49526: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 24 12:22:41 host2 sshd[2038857]: Disconnected from invalid user appltest 103.217.144.161 port 46446 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 24 12:23:47 host2 sshd[2039482]: Disconnected from invalid user forum 103.217.144.161 port 50222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 24 12:24:44 host2 sshd[2040211]: Disconnected from invalid user edward 103.217.144.161 port 36334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 24 12:25:38 host2 sshd[2041005]: Disconnected from invalid user swg 103.217.144.161 port 53590 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.61.223.230
country_id: 2017370
description:
[2025-12-24 12:27:32 +0530] info [webmaild] 185.61.223.230 - info@sivagnanamfoundation.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2025-12-24 12:29:03 dovecot_login authenticator failed for H=104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:33739: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2025-12-24 12:28:43 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:40860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.47.210
country_id: 6252001
description:
[2025-12-24 12:31:47 +0530] info [cpaneld] 129.222.47.210 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.37.204.223
country_id: 6252001
description:
[2025-12-24 12:31:46 +0530] info [cpaneld] 99.37.204.223 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.223.110.220
country_id: 6252001
description:
[2025-12-24 12:31:34 +0530] info [cpaneld] 73.223.110.220 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.210.53
country_id: 6252001
description:
[2025-12-24 12:31:38 +0530] info [cpaneld] 75.4.210.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.249.178.237
country_id: 6252001
description:
[2025-12-24 12:31:43 +0530] info [whostmgrd] 68.249.178.237 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.76.53.110
country_id: 6252001
description:
[2025-12-24 12:31:42 +0530] info [cpaneld] 71.76.53.110 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.244.88.186
country_id: 6252001
description:
[2025-12-24 12:31:44 +0530] info [cpaneld] 108.244.88.186 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-24 12:32:52 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:37326: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-24 12:33:17 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:48470: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 12:34:57 host2 pure-ftpd[2049170]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-24 12:36:16 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:60075: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2025-12-24 12:35:34 dovecot_login authenticator failed for H=(202.140.38.110.convergentindia.com) [202.140.38.110]:45620: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-24 12:37:10 dovecot_login authenticator failed for H=([125.19.169.115]) [128.185.235.110]:34320: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-12-24 12:36:45 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:34620: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.236
country_id: 6252001
description:
Dec 24 12:40:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.236, lip=66.85.158.91, TLS, session=<AFxKW61GOvHG6xjs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.158.169.155
country_id: 6252001
description:
[2025-12-24 12:45:17 +0530] info [cpaneld] 38.158.169.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.112.56.7
country_id: 6252001
description:
[2025-12-24 12:45:19 +0530] info [cpaneld] 24.112.56.7 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.212
country_id: 953987
description:
Dec 24 12:45:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=102.129.56.212, lip=66.85.158.91, TLS, session=<wgMPa61GoYdmgTjU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.208.46.204
country_id: 6252001
description:
[2025-12-24 12:45:22 +0530] info [whostmgrd] 71.208.46.204 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.134.98
country_id: 6252001
description:
[2025-12-24 12:45:13 +0530] info [cpaneld] 38.62.134.98 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.42.48.61
country_id: 6252001
description:
[2025-12-24 12:45:24 +0530] info [cpaneld] 47.42.48.61 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.53.21
country_id: 6252001
description:
[2025-12-24 12:45:27 +0530] info [cpaneld] 76.33.53.21 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.69.177.65
country_id: 6252001
description:
[2025-12-24 12:45:29 +0530] info [cpaneld] 74.69.177.65 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.47.117.45
country_id: 6252001
description:
[2025-12-24 12:46:13 +0530] info [cpaneld] 98.47.117.45 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.36.75.18
country_id: 6252001
description:
[2025-12-24 12:46:05 +0530] info [cpaneld] 100.36.75.18 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.14.152.6
country_id: 6252001
description:
[2025-12-24 12:46:04 +0530] info [cpaneld] 69.14.152.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.129.136.217
country_id: 6252001
description:
[2025-12-24 12:46:08 +0530] info [cpaneld] 73.129.136.217 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.109.59.62
country_id: 3469034
description:
Dec 24 12:45:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.109.59.62, lip=66.85.158.91, TLS, session=<IQ/3bK1Gn6GzbTs+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.90.122.31
country_id: 6252001
description:
[2025-12-24 12:46:03 +0530] info [cpaneld] 173.90.122.31 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.53.118.102
country_id: 6252001
description:
[2025-12-24 12:46:07 +0530] info [whostmgrd] 73.53.118.102 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.59.92.239
country_id: 6252001
description:
[2025-12-24 12:46:15 +0530] info [cpaneld] 45.59.92.239 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.32
country_id: 690791
description:
Dec 24 12:49:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=176.103.11.32, lip=66.85.158.91, TLS, session=<TG4Ce61G86uwZwsg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.119
country_id: 3469034
description:
Dec 24 12:50:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=191.53.128.119, lip=66.85.158.91, TLS, session=<WyowfK1GTru/NYB3>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.27
country_id: 2328926
description:
Dec 24 12:53:40 host2 pure-ftpd[2067622]: (?@102.204.223.27) [INFO] New connection from 102.204.223.27


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.15.225.49
country_id: 617790
description:
Dec 24 12:56:21 host2 sshd[2070546]: Disconnecting authenticating user root 45.15.225.49 port 58408: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 24 12:55:48 host2 sshd[2070061]: Disconnected from invalid user ftpuser 84.51.43.58 port 61445 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.15.225.49
country_id: 617790
description:
Dec 24 12:56:21 host2 sshd[2070546]: error: maximum authentication attempts exceeded for root from 45.15.225.49 port 58408 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.15.225.49
country_id: 617790
description:
Dec 24 12:56:30 host2 sshd[2070647]: Disconnecting authenticating user root 45.15.225.49 port 36652: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.15.225.49
country_id: 617790
description:
Dec 24 12:56:30 host2 sshd[2070647]: error: maximum authentication attempts exceeded for root from 45.15.225.49 port 36652 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.15.225.49
country_id: 617790
description:
Dec 24 12:56:41 host2 sshd[2070837]: Disconnecting invalid user admin 45.15.225.49 port 44258: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.177
country_id: 953987
description:
Dec 24 12:57:48 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=102.64.43.177, lip=66.85.158.91, TLS, session=<VXLDl61GcudmQCux>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Dec 24 12:57:54 host2 sshd[2071890]: Disconnected from invalid user neko 69.49.246.176 port 44866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.25.219
country_id: 3469034
description:
Dec 24 12:57:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=168.194.25.219, lip=66.85.158.91, TLS, session=<JUdYmK1Gi5aowhnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.29.80
country_id: 933860
description:
Dec 24 12:58:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=83.143.29.80, lip=66.85.158.91, TLS, session=<+f8Jma1GeOlTjx1Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.179
country_id: 3175395
description:
Dec 24 12:58:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=185.197.9.179, lip=66.85.158.91, TLS, session=<5mp9ma1G4MO5xQmz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-24 12:58:39 dovecot_login authenticator failed for H=([121.73.162.242]) [121.73.162.242]:52732: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.207.252.141
country_id: 6252001
description:
[2025-12-24 13:00:13 +0530] info [cpaneld] 67.207.252.141 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.40.59.140
country_id: 6252001
description:
[2025-12-24 13:00:17 +0530] info [whostmgrd] 47.40.59.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.222.20.77
country_id: 6252001
description:
[2025-12-24 13:00:21 +0530] info [cpaneld] 71.222.20.77 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.35.148.63
country_id: 6252001
description:
[2025-12-24 13:00:23 +0530] info [cpaneld] 50.35.148.63 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 24 12:59:46 host2 sshd[2073570]: Disconnected from invalid user xuhao 84.51.43.58 port 43080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Dec 24 12:59:49 host2 sshd[2073640]: Disconnected from invalid user neko 122.54.18.220 port 9579 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.11.38.9
country_id: 6252001
description:
[2025-12-24 13:00:08 +0530] info [cpaneld] 71.11.38.9 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.27.193.89
country_id: 6252001
description:
[2025-12-24 13:00:10 +0530] info [cpaneld] 65.27.193.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 24 12:59:49 host2 sshd[2073623]: Disconnected from invalid user qa 165.232.178.116 port 55878 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.241.181
country_id: 6252001
description:
[2025-12-24 13:00:20 +0530] info [cpaneld] 68.224.241.181 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 24 13:01:16 host2 sshd[2075441]: Disconnected from invalid user eren 165.232.178.116 port 59500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-24 13:01:28 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:39876: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.179.25.106
country_id: 6252001
description:
[2025-12-24 13:02:00 +0530] info [cpaneld] 104.179.25.106 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.50.111.9
country_id: 6252001
description:
[2025-12-24 13:01:51 +0530] info [cpaneld] 68.50.111.9 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.202.210.2
country_id: 6252001
description:
[2025-12-24 13:01:53 +0530] info [cpaneld] 104.202.210.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.5.180.206
country_id: 6252001
description:
[2025-12-24 13:01:55 +0530] info [cpaneld] 24.5.180.206 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 24 13:01:58 host2 sshd[2076032]: Disconnected from invalid user lee 165.232.178.116 port 47356 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.113.167.111
country_id: 6252001
description:
[2025-12-24 13:01:56 +0530] info [whostmgrd] 99.113.167.111 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.211.184.218
country_id: 6252001
description:
[2025-12-24 13:01:58 +0530] info [cpaneld] 73.211.184.218 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.199.121.136
country_id: 6252001
description:
[2025-12-24 13:01:59 +0530] info [cpaneld] 71.199.121.136 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-24 13:01:47 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:59464: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Dec 24 13:03:53 host2 sshd[2078062]: Disconnected from invalid user alex 122.54.18.220 port 58979 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Dec 24 13:05:11 host2 sshd[2079421]: Disconnected from invalid user io 122.54.18.220 port 54025 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 24 13:05:22 host2 sshd[2079637]: Disconnected from invalid user web 165.232.178.116 port 43082 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.214.98.173
country_id: 6252001
description:
[2025-12-24 13:07:09 +0530] info [cpaneld] 195.214.98.173 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.128.70.90
country_id: 6252001
description:
[2025-12-24 13:07:11 +0530] info [cpaneld] 73.128.70.90 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.240.162.44
country_id: 6252001
description:
[2025-12-24 13:07:12 +0530] info [whostmgrd] 23.240.162.44 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.176.178.65
country_id: 6252001
description:
[2025-12-24 13:07:16 +0530] info [cpaneld] 174.176.178.65 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.83.40.26
country_id: 6252001
description:
[2025-12-24 13:07:17 +0530] info [cpaneld] 72.83.40.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.196.231.189
country_id: 6252001
description:
[2025-12-24 13:07:19 +0530] info [cpaneld] 71.196.231.189 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.209.44
country_id: 6252001
description:
[2025-12-24 13:07:08 +0530] info [cpaneld] 174.160.209.44 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.11.179.18
country_id: 953987
description:
2025-12-24 13:10:12 dovecot_plain authenticator failed for H=(X58MAJ152S6) [196.11.179.18]:64813: 535 Incorrect authentication data (set_id=onila.selaka@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 24 13:10:45 host2 sshd[2085434]: Disconnected from invalid user web 182.93.7.194 port 49008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 24 13:13:13 host2 sshd[2087739]: Disconnected from invalid user share 182.93.7.194 port 50702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 24 13:13:31 host2 sshd[2088024]: Disconnected from invalid user share 182.93.7.194 port 63926 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.36.133.162
country_id: 6252001
description:
[2025-12-24 13:15:56 +0530] info [cpaneld] 98.36.133.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.207.161.221
country_id: 6252001
description:
[2025-12-24 13:15:59 +0530] info [cpaneld] 162.207.161.221 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.28.237.19
country_id: 6252001
description:
[2025-12-24 13:16:01 +0530] info [cpaneld] 98.28.237.19 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 24 13:16:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oK9N2q1GqLK58uIh>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.59.222.122
country_id: 6252001
description:
[2025-12-24 13:15:55 +0530] info [cpaneld] 24.59.222.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.98.202.255
country_id: 6252001
description:
[2025-12-24 13:16:00 +0530] info [whostmgrd] 64.98.202.255 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.117.205.118
country_id: 6252001
description:
[2025-12-24 13:16:03 +0530] info [cpaneld] 98.117.205.118 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.236.220.23
country_id: 6252001
description:
[2025-12-24 13:16:02 +0530] info [cpaneld] 108.236.220.23 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.130
country_id: 6252001
description:
Dec 24 13:17:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.130, lip=66.85.158.92, TLS, session=<I4QL361GFPfG6xiC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.55.161.214
country_id: 6252001
description:
[2025-12-24 13:18:41 +0530] info [cpaneld] 99.55.161.214 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.54.9.49
country_id: 6252001
description:
[2025-12-24 13:18:33 +0530] info [cpaneld] 73.54.9.49 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.211.42.186
country_id: 6252001
description:
[2025-12-24 13:18:35 +0530] info [cpaneld] 47.211.42.186 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.65.167.122
country_id: 6252001
description:
[2025-12-24 13:18:36 +0530] info [cpaneld] 152.65.167.122 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.253.96.190
country_id: 6252001
description:
[2025-12-24 13:18:37 +0530] info [whostmgrd] 24.253.96.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.11.96.133
country_id: 6252001
description:
[2025-12-24 13:18:39 +0530] info [cpaneld] 100.11.96.133 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.34.157.1
country_id: 6252001
description:
[2025-12-24 13:18:40 +0530] info [cpaneld] 192.34.157.1 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 24 13:20:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Pijt6q1Gzuq58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-24 13:20:52 dovecot_login authenticator failed for H=([182.75.215.245]) [182.75.215.245]:60850: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 24 13:23:30 host2 sshd[2098155]: Disconnected from invalid user admin 182.93.7.194 port 53240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.97.76.117
country_id: 1605651
description:
2025-12-24 13:24:51 dovecot_plain authenticator failed for H=ppp-171-97-76-117.revip8.asianet.co.th (6MB1PQ8V7O8RZW8) [171.97.76.117]:8921: 535 Incorrect authentication data (set_id=punsarani.ariyawansha@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 13:26:15 host2 sshd[2100495]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-12-24 13:28:56 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:33113: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-24 13:29:06 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:58245: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.63.218.78
country_id: 6252001
description:
[2025-12-24 13:30:46 +0530] info [whostmgrd] 99.63.218.78 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.194.22.216
country_id: 6252001
description:
[2025-12-24 13:30:37 +0530] info [cpaneld] 71.194.22.216 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.165.191.216
country_id: 6252001
description:
[2025-12-24 13:30:41 +0530] info [cpaneld] 98.165.191.216 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.13.111
country_id: 6252001
description:
[2025-12-24 13:30:42 +0530] info [cpaneld] 172.56.13.111 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.116.41.147
country_id: 6252001
description:
[2025-12-24 13:30:48 +0530] info [cpaneld] 23.116.41.147 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.168.229.122
country_id: 6252001
description:
[2025-12-24 13:30:49 +0530] info [cpaneld] 68.168.229.122 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.44.175.72
country_id: 6252001
description:
[2025-12-24 13:30:53 +0530] info [cpaneld] 209.44.175.72 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-24 13:31:15 dovecot_login authenticator failed for H=(eoRroeoPt) [69.5.189.21]:49619: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.136.173.147
country_id: 6252001
description:
[2025-12-24 13:31:37 +0530] info [cpaneld] 35.136.173.147 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.100.96.56
country_id: 6252001
description:
[2025-12-24 13:31:40 +0530] info [cpaneld] 97.100.96.56 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.197.203.205
country_id: 6252001
description:
[2025-12-24 13:31:38 +0530] info [cpaneld] 24.197.203.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.250.226.122
country_id: 6252001
description:
[2025-12-24 13:31:45 +0530] info [cpaneld] 172.250.226.122 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-24 13:31:38 dovecot_login authenticator failed for H=(VKX8HkK) [69.5.189.21]:63274: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.89.32.245
country_id: 6252001
description:
[2025-12-24 13:31:41 +0530] info [whostmgrd] 99.89.32.245 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.11.105.184
country_id: 6252001
description:
[2025-12-24 13:31:43 +0530] info [cpaneld] 66.11.105.184 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.229.161.121
country_id: 6252001
description:
[2025-12-24 13:31:44 +0530] info [cpaneld] 207.229.161.121 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-24 13:33:09 dovecot_login authenticator failed for H=(Sd7VhaUx6I) [69.5.189.21]:56831: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Dec 24 13:34:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=</USJGq5Gus1APpwY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-24 13:33:33 dovecot_login authenticator failed for H=(zFTaAJwOvW) [69.5.189.21]:52489: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.0.232.23
country_id: 6252001
description:
[2025-12-24 13:35:28 +0530] info [cpaneld] 172.0.232.23 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Dec 24 13:34:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.24, lip=66.85.158.91, TLS: Connection closed, session=<udl0HK5G7sZAPpwY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.52.135.224
country_id: 6252001
description:
[2025-12-24 13:35:10 +0530] info [cpaneld] 24.52.135.224 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.128.85.205
country_id: 6252001
description:
[2025-12-24 13:35:14 +0530] info [whostmgrd] 216.128.85.205 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.133.114
country_id: 6252001
description:
[2025-12-24 13:35:18 +0530] info [cpaneld] 174.134.133.114 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.89.203.78
country_id: 6252001
description:
[2025-12-24 13:35:29 +0530] info [cpaneld] 75.89.203.78 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.253.120.126
country_id: 6252001
description:
[2025-12-24 13:35:12 +0530] info [cpaneld] 96.253.120.126 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.23.55.8
country_id: 6252001
description:
[2025-12-24 13:35:13 +0530] info [cpaneld] 184.23.55.8 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.9.142.191
country_id: 6252001
description:
[2025-12-24 13:35:16 +0530] info [cpaneld] 75.9.142.191 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.208.44
country_id: 6252001
description:
[2025-12-24 13:35:17 +0530] info [cpaneld] 23.241.208.44 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.122
country_id: 2300660
description:
Dec 24 13:35:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=41.139.0.122, lip=66.85.158.91, TLS, session=<ECMaHq5GIZMpiwB6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.34.44.128
country_id: 6252001
description:
[2025-12-24 13:35:30 +0530] info [cpaneld] 104.34.44.128 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.156.3
country_id: 6252001
description:
[2025-12-24 13:35:37 +0530] info [whostmgrd] 76.32.156.3 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.59.202.112
country_id: 6252001
description:
[2025-12-24 13:35:39 +0530] info [cpaneld] 38.59.202.112 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.34
country_id: 798544
description:
Dec 24 13:35:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=178.216.28.34, lip=66.85.158.91, TLS, session=<uxZDH65G8K2y2Bwi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.64.107.46
country_id: 6252001
description:
[2025-12-24 13:35:40 +0530] info [cpaneld] 75.64.107.46 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.227.98.98
country_id: 6252001
description:
[2025-12-24 13:35:41 +0530] info [cpaneld] 72.227.98.98 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 13:37:11 host2 sshd[2114042]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 13:37:06 host2 pure-ftpd[2114004]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.103.24.186
country_id: 6252001
description:
[2025-12-24 13:38:46 +0530] info [cpaneld] 50.103.24.186 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.37.108
country_id: 6252001
description:
[2025-12-24 13:38:47 +0530] info [cpaneld] 172.59.37.108 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.34.39.159
country_id: 6252001
description:
[2025-12-24 13:38:48 +0530] info [cpaneld] 136.34.39.159 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.146.183.30
country_id: 6252001
description:
[2025-12-24 13:38:38 +0530] info [cpaneld] 67.146.183.30 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.83.47.81
country_id: 6252001
description:
[2025-12-24 13:38:40 +0530] info [cpaneld] 99.83.47.81 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.56.140.120
country_id: 6252001
description:
[2025-12-24 13:38:39 +0530] info [cpaneld] 184.56.140.120 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.246.207.170
country_id: 6252001
description:
[2025-12-24 13:38:45 +0530] info [whostmgrd] 162.246.207.170 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-24 13:48:22 dovecot_login authenticator failed for H=([152.52.231.202]) [152.52.231.202]:55662: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-24 13:48:01 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:48242: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.151.7
country_id: 6252001
description:
[2025-12-24 13:50:22 +0530] info [cpaneld] 70.170.151.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.43.211.232
country_id: 6252001
description:
[2025-12-24 13:50:24 +0530] info [cpaneld] 67.43.211.232 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.177.149.138
country_id: 6252001
description:
[2025-12-24 13:50:14 +0530] info [cpaneld] 97.177.149.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.79.94.250
country_id: 6252001
description:
[2025-12-24 13:50:16 +0530] info [cpaneld] 142.79.94.250 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.237.253.1
country_id: 6252001
description:
[2025-12-24 13:50:17 +0530] info [cpaneld] 216.237.253.1 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.237.110
country_id: 6252001
description:
[2025-12-24 13:50:18 +0530] info [whostmgrd] 76.32.237.110 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.177.91.243
country_id: 6252001
description:
[2025-12-24 13:50:19 +0530] info [cpaneld] 67.177.91.243 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-24 13:50:39 dovecot_login authenticator failed for H=(125-209-116-242.multi.net.pk) [58.27.253.6]:36010: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-24 13:51:07 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:50674: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Dec 24 13:52:35 host2 sshd[2128002]: Disconnected from invalid user adminuser 45.169.200.254 port 51078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Dec 24 13:55:06 host2 sshd[2130282]: Disconnected from invalid user nrk 45.169.200.254 port 41890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.169.200.254
country_id: 3469034
description:
Dec 24 13:56:18 host2 sshd[2131399]: Disconnected from invalid user foundry 45.169.200.254 port 37294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 24 13:55:54 host2 sshd[2131087]: Disconnected from invalid user toto 118.194.230.231 port 53340 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 24 13:57:25 host2 sshd[2132319]: Received disconnect from 206.81.3.175 port 50444:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Dec 24 13:56:53 host2 sshd[2131887]: Disconnected from invalid user deployer 45.169.200.254 port 49112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.105
country_id: 953987
description:
Dec 24 13:57:42 host2 sshd[2132506]: Disconnected from invalid user adminuser 102.210.149.105 port 33030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 24 13:57:54 host2 sshd[2132656]: Disconnected from invalid user u1 118.194.230.231 port 53536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 24 13:58:25 host2 sshd[2133046]: Disconnected from invalid user git 206.81.3.175 port 38064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 24 13:58:56 host2 sshd[2133575]: Disconnected from invalid user adminuser 206.81.3.175 port 59992 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 24 13:59:27 host2 sshd[2134097]: Disconnected from invalid user deployer 206.81.3.175 port 52650 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.121
country_id: 798544
description:
Dec 24 14:01:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=91.240.44.121, lip=66.85.158.91, TLS, session=<K71Ie65GtMlb8Cx5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.87.244.167
country_id: 6252001
description:
[2025-12-24 14:00:55 +0530] info [cpaneld] 67.87.244.167 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.35.53.204
country_id: 6252001
description:
[2025-12-24 14:00:56 +0530] info [cpaneld] 136.35.53.204 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.145.153.31
country_id: 6252001
description:
[2025-12-24 14:00:59 +0530] info [cpaneld] 35.145.153.31 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.115.110.227
country_id: 6252001
description:
[2025-12-24 14:00:58 +0530] info [whostmgrd] 172.115.110.227 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.74.60.61
country_id: 6252001
description:
[2025-12-24 14:00:57 +0530] info [cpaneld] 24.74.60.61 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.220.78.70
country_id: 6252001
description:
[2025-12-24 14:01:00 +0530] info [cpaneld] 32.220.78.70 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.210.139.142
country_id: 6252001
description:
[2025-12-24 14:01:02 +0530] info [cpaneld] 76.210.139.142 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.43.59
country_id: 6290252
description:
Dec 24 14:01:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.207.43.59, lip=66.85.158.91, TLS, session=</jVZfK5GrOZtzys7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 24 14:01:59 host2 sshd[2136835]: Disconnected from invalid user support 45.40.57.41 port 34042 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 24 14:03:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS: Connection closed, session=<PA7Hg65G6nJChJl9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 24 14:03:40 host2 sshd[2138402]: Disconnected from invalid user devtest 45.40.57.41 port 36500 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 24 14:05:12 host2 sshd[2140001]: Disconnected from invalid user user 45.40.57.41 port 40834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 24 14:05:52 host2 sshd[2140835]: Disconnected from invalid user postgres 45.40.57.41 port 53146 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.153.125.246
country_id: 6252001
description:
[2025-12-24 14:07:14 +0530] info [cpaneld] 76.153.125.246 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.113.15.119
country_id: 6252001
description:
[2025-12-24 14:07:17 +0530] info [cpaneld] 99.113.15.119 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.240.136.174
country_id: 6252001
description:
[2025-12-24 14:07:21 +0530] info [whostmgrd] 173.240.136.174 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.217.83.127
country_id: 6252001
description:
[2025-12-24 14:07:20 +0530] info [cpaneld] 173.217.83.127 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.58.65.136
country_id: 6252001
description:
[2025-12-24 14:07:23 +0530] info [cpaneld] 68.58.65.136 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.14.122.163
country_id: 6252001
description:
[2025-12-24 14:07:24 +0530] info [cpaneld] 24.14.122.163 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.67.91
country_id: 6252001
description:
[2025-12-24 14:07:26 +0530] info [cpaneld] 47.148.67.91 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.39.204
country_id: 6252001
description:
[2025-12-24 14:08:05 +0530] info [cpaneld] 47.152.39.204 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.48.143.45
country_id: 6252001
description:
[2025-12-24 14:08:06 +0530] info [cpaneld] 199.48.143.45 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-24 14:07:38 dovecot_login authenticator failed for H=([62.97.163.187]) [62.97.163.187]:37066: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.184.104
country_id: 6252001
description:
[2025-12-24 14:08:02 +0530] info [cpaneld] 169.150.184.104 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.152.123.145
country_id: 6252001
description:
[2025-12-24 14:08:07 +0530] info [cpaneld] 99.152.123.145 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-24 14:08:13 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:58074: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.88.134.74
country_id: 6252001
description:
[2025-12-24 14:08:01 +0530] info [cpaneld] 173.88.134.74 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.2.91.208
country_id: 6252001
description:
[2025-12-24 14:08:03 +0530] info [cpaneld] 24.2.91.208 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.14.134.234
country_id: 6252001
description:
[2025-12-24 14:08:04 +0530] info [whostmgrd] 104.14.134.234 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-24 14:13:40 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:51065: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.165.166.121
country_id: 6252001
description:
[2025-12-24 14:14:11 +0530] info [cpaneld] 73.165.166.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.158.71.109
country_id: 6252001
description:
[2025-12-24 14:14:13 +0530] info [cpaneld] 76.158.71.109 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.230.249.51
country_id: 6252001
description:
[2025-12-24 14:14:18 +0530] info [whostmgrd] 75.230.249.51 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.208.109.124
country_id: 6252001
description:
[2025-12-24 14:13:22 +0530] info [cpaneld] 108.208.109.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.12.52.10
country_id: 6252001
description:
[2025-12-24 14:13:28 +0530] info [cpaneld] 172.12.52.10 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.85.6.63
country_id: 6252001
description:
[2025-12-24 14:13:33 +0530] info [cpaneld] 174.85.6.63 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.114.222.115
country_id: 6252001
description:
[2025-12-24 14:13:37 +0530] info [cpaneld] 68.114.222.115 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.91.168.168
country_id: 6252001
description:
[2025-12-24 14:14:17 +0530] info [cpaneld] 173.91.168.168 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.8.225.99
country_id: 6252001
description:
[2025-12-24 14:14:20 +0530] info [cpaneld] 216.8.225.99 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.94.188
country_id: 6252001
description:
[2025-12-24 14:13:23 +0530] info [cpaneld] 47.150.94.188 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.171.76.120
country_id: 6252001
description:
[2025-12-24 14:13:25 +0530] info [whostmgrd] 97.171.76.120 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.94.145.145
country_id: 6252001
description:
[2025-12-24 14:14:21 +0530] info [cpaneld] 71.94.145.145 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.91.153.160
country_id: 6252001
description:
[2025-12-24 14:14:24 +0530] info [cpaneld] 24.91.153.160 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.83
country_id: 6252001
description:
Dec 24 14:14:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.193.83, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gLgwq65G2M0UQcFT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.5
country_id: 2750405
description:
Dec 24 14:16:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=31.14.32.5, lip=66.85.158.92, TLS: Connection closed, session=<Tvzjsq5GftsfDiAF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Dec 24 14:18:18 host2 sshd[2155263]: Disconnected from invalid user swg 125.31.2.160 port 49614 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.5
country_id: 2750405
description:
Dec 24 14:17:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=31.14.32.5, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1luXta5GuskfDiAF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.195.73.45
country_id: 3469034
description:
Dec 24 14:18:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=168.195.73.45, lip=66.85.158.91, TLS, session=<PW+zua5GGZSow0kt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.183
country_id: 3865483
description:
Dec 24 14:19:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=45.238.106.183, lip=66.85.158.91, TLS, session=<Es5/u65G/9Ut7mq3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Dec 24 14:21:52 host2 sshd[2159618]: Disconnected from invalid user student 125.31.2.160 port 60616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-24 14:23:11 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:48526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.31.2.160
country_id: 1821275
description:
Dec 24 14:22:28 host2 sshd[2160292]: Disconnected from invalid user deluge 125.31.2.160 port 44136 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.3.169
country_id: 6252001
description:
[2025-12-24 14:24:56 +0530] info [webmaild] 140.235.3.169 - info@simple-engineering.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@simple-engineering.lk has their account suspended. Login blocked.


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-12-24 14:29:23 1vYKiI-00000009648-3tdl <= wordpress@venee.lk U=veneelk P=local S=36243 id=vntFcK1QrhXNKCdU9fzo5FG8SNebhjK6tOH9gzD7k@coatrent.venee.lk T="Failed login by IP 142.248.80.192 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec 24 14:29:28 host2 sshd[2168393]: Disconnected from invalid user steam 52.169.142.214 port 45860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:29:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<oboL4a5GGtQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:30:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<31RQ5a5GlOYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:31:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<i84w6a5GFN0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:32:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<B0ll7K5GBMYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:33:34 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<1lZk765GvO0DhpQ7>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 60.246.120.30
country_id: 1821275
description:
Dec 24 14:34:13 host2 sshd[2174220]: Disconnecting authenticating user root 60.246.120.30 port 40850: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 60.246.120.30
country_id: 1821275
description:
Dec 24 14:34:13 host2 sshd[2174220]: error: maximum authentication attempts exceeded for root from 60.246.120.30 port 40850 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec 24 14:34:37 host2 sshd[2174671]: Disconnected from invalid user teamspeak 52.169.142.214 port 38002 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:34:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4l1A865G+MgDhpQ7>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 60.246.120.30
country_id: 1821275
description:
Dec 24 14:34:21 host2 sshd[2174345]: Disconnecting authenticating user root 60.246.120.30 port 32778: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 60.246.120.30
country_id: 1821275
description:
Dec 24 14:34:21 host2 sshd[2174345]: error: maximum authentication attempts exceeded for root from 60.246.120.30 port 32778 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 60.246.120.30
country_id: 1821275
description:
Dec 24 14:34:28 host2 sshd[2174481]: Disconnecting invalid user admin 60.246.120.30 port 51382: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.169.142.214
country_id: 2963597
description:
Dec 24 14:35:45 host2 sshd[2176025]: Disconnected from invalid user developer 52.169.142.214 port 52148 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.10.126.73
country_id: 6252001
description:
[2025-12-24 14:37:13 +0530] info [cpaneld] 66.10.126.73 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.131.16.255
country_id: 6252001
description:
[2025-12-24 14:37:14 +0530] info [cpaneld] 174.131.16.255 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:36:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<wrJ6+a5GqJcDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.230.102.130
country_id: 3996063
description:
Dec 24 14:37:06 host2 sshd[2177400]: Disconnected from invalid user teamspeak 187.230.102.130 port 57684 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.202.121
country_id: 6252001
description:
[2025-12-24 14:37:16 +0530] info [cpaneld] 172.89.202.121 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.103.80.209
country_id: 6252001
description:
[2025-12-24 14:37:18 +0530] info [whostmgrd] 172.103.80.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.89.227
country_id: 6252001
description:
[2025-12-24 14:37:39 +0530] info [cpaneld] 174.160.89.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:37:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ayfn/K5G6NcDhpQ7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.170.69.184
country_id: 6252001
description:
[2025-12-24 14:37:22 +0530] info [cpaneld] 67.170.69.184 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.54.6.190
country_id: 6252001
description:
[2025-12-24 14:37:36 +0530] info [cpaneld] 104.54.6.190 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.159.198.202
country_id: 6252001
description:
[2025-12-24 14:37:42 +0530] info [whostmgrd] 73.159.198.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.117.20.244
country_id: 6252001
description:
[2025-12-24 14:37:43 +0530] info [cpaneld] 23.117.20.244 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.172.203.181
country_id: 6252001
description:
[2025-12-24 14:37:46 +0530] info [cpaneld] 207.172.203.181 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.9.13
country_id: 6252001
description:
[2025-12-24 14:37:44 +0530] info [cpaneld] 38.43.9.13 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.205.118.8
country_id: 6252001
description:
[2025-12-24 14:37:21 +0530] info [cpaneld] 151.205.118.8 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.69.44.89
country_id: 6252001
description:
[2025-12-24 14:37:24 +0530] info [cpaneld] 68.69.44.89 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.187.146.60
country_id: 6252001
description:
[2025-12-24 14:37:41 +0530] info [cpaneld] 173.187.146.60 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 14:38:32 host2 pure-ftpd[2178515]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.9
country_id: 798549
description:
Dec 24 14:41:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.9, lip=66.85.158.91, TLS: Connection closed, session=<Pqk6C69GRLlV2YwJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.103
country_id: 6252001
description:
Dec 24 14:43:55 host2 pure-ftpd[2183182]: (?@198.235.24.103) [INFO] New connection from 198.235.24.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.211.20
country_id: 6252001
description:
[2025-12-24 14:44:33 +0530] info [cpaneld] 38.156.211.20 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.82.249.158
country_id: 6252001
description:
[2025-12-24 14:44:22 +0530] info [cpaneld] 75.82.249.158 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.85.64.214
country_id: 6252001
description:
[2025-12-24 14:44:23 +0530] info [cpaneld] 146.85.64.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.137.98.142
country_id: 6252001
description:
[2025-12-24 14:44:27 +0530] info [whostmgrd] 166.137.98.142 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.248.18.238
country_id: 6252001
description:
[2025-12-24 14:44:25 +0530] info [cpaneld] 173.248.18.238 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.140.196.58
country_id: 6252001
description:
[2025-12-24 14:44:28 +0530] info [cpaneld] 107.140.196.58 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.119.15.49
country_id: 6252001
description:
[2025-12-24 14:44:30 +0530] info [cpaneld] 172.119.15.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-24 14:45:49 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:39643: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.81.169.66
country_id: 6252001
description:
[2025-12-24 14:47:13 +0530] info [cpaneld] 74.81.169.66 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.200.86.174
country_id: 6252001
description:
[2025-12-24 14:47:16 +0530] info [cpaneld] 71.200.86.174 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-24 14:46:22 dovecot_login authenticator failed for H=(201.173.250.36-clientes-izzi.mx) [201.173.250.36]:41505: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.86.148.104
country_id: 6252001
description:
[2025-12-24 14:47:12 +0530] info [whostmgrd] 76.86.148.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.145.37.244
country_id: 6252001
description:
[2025-12-24 14:47:10 +0530] info [cpaneld] 47.145.37.244 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.212.30
country_id: 6252001
description:
[2025-12-24 14:47:15 +0530] info [cpaneld] 76.34.212.30 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.29.116.216
country_id: 6252001
description:
[2025-12-24 14:47:08 +0530] info [cpaneld] 174.29.116.216 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.33.194.154
country_id: 6252001
description:
[2025-12-24 14:47:09 +0530] info [cpaneld] 99.33.194.154 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-24 14:48:07 dovecot_login authenticator failed for H=(dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:34054: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-12-24 14:48:40 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:32910: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.173.216.172
country_id: 6252001
description:
[2025-12-24 14:48:47 +0530] info [cpaneld] 73.173.216.172 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.72.174
country_id: 6252001
description:
[2025-12-24 14:48:48 +0530] info [cpaneld] 167.248.72.174 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.210.241.220
country_id: 6252001
description:
[2025-12-24 14:48:52 +0530] info [whostmgrd] 97.210.241.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.62.179.134
country_id: 6252001
description:
[2025-12-24 14:48:55 +0530] info [cpaneld] 174.62.179.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.68.205.141
country_id: 6252001
description:
[2025-12-24 14:48:56 +0530] info [cpaneld] 199.68.205.141 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.4.181
country_id: 6252001
description:
[2025-12-24 14:48:46 +0530] info [cpaneld] 174.134.4.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.147.252
country_id: 6252001
description:
[2025-12-24 14:48:54 +0530] info [cpaneld] 47.141.147.252 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-12-24 14:49:28 1vYL1j-00000009BGj-3k1B <= wordpress@venee.lk U=veneelk P=local S=36251 id=QfmJjbcNgnA3r52BWhW3ztXYPVlLDohvotlXofwQocY@coatrent.venee.lk T="Failed login by IP 142.248.80.192 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.138
country_id: 3469034
description:
Dec 24 14:56:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=177.44.96.138, lip=66.85.158.91, TLS, session=<KmlVQK9GfcaxLGCK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.23.184.136
country_id: 3469034
description:
Dec 24 14:56:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.23.184.136, lip=66.85.158.91, TLS, session=<hByPQa9GudqxF7iI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.49.94.210
country_id: 6252001
description:
[2025-12-24 14:59:19 +0530] info [cpaneld] 38.49.94.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.191.115.177
country_id: 6252001
description:
[2025-12-24 14:59:20 +0530] info [cpaneld] 67.191.115.177 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.79.44.249
country_id: 6252001
description:
[2025-12-24 14:59:24 +0530] info [cpaneld] 73.79.44.249 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.82.193.47
country_id: 6252001
description:
[2025-12-24 14:59:38 +0530] info [whostmgrd] 99.82.193.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.179.181.115
country_id: 6252001
description:
[2025-12-24 14:59:42 +0530] info [cpaneld] 99.179.181.115 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.155.73.50
country_id: 6252001
description:
[2025-12-24 14:59:40 +0530] info [cpaneld] 192.155.73.50 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.194.151.213
country_id: 6252001
description:
[2025-12-24 14:59:43 +0530] info [cpaneld] 68.194.151.213 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.20.96.49
country_id: 6252001
description:
[2025-12-24 14:59:25 +0530] info [cpaneld] 76.20.96.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.50.160.28
country_id: 6252001
description:
[2025-12-24 14:59:32 +0530] info [cpaneld] 173.50.160.28 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.197.47.195
country_id: 6252001
description:
[2025-12-24 14:59:34 +0530] info [cpaneld] 72.197.47.195 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.168.238
country_id: 6252001
description:
[2025-12-24 14:59:22 +0530] info [cpaneld] 65.185.168.238 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 24 15:00:17 host2 sshd[2198415]: Disconnected from invalid user hadoop 209.141.52.88 port 48640 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.205.153.133
country_id: 6252001
description:
[2025-12-24 14:59:23 +0530] info [whostmgrd] 170.205.153.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.101.78
country_id: 6252001
description:
[2025-12-24 14:59:27 +0530] info [cpaneld] 73.199.101.78 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.72.107.253
country_id: 6252001
description:
[2025-12-24 14:59:36 +0530] info [cpaneld] 73.72.107.253 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.121
country_id: 6252001
description:
Dec 24 15:00:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.121, lip=66.85.158.91, TLS handshaking: Connection closed, session=<L8RMUa9GvskUQGl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-24 15:01:39 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:59384: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Dec 24 15:02:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.129, lip=66.85.158.91, TLS: Connection closed, session=<2KK0Va9GiLNChJmB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 24 15:02:40 host2 sshd[2200170]: Disconnected from invalid user u1 209.141.52.88 port 39276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.8
country_id: 798549
description:
Dec 24 15:02:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.8, lip=66.85.158.91, session=<gl4kWK9GYtFV2ZUI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-24 15:02:38 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:54372: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 24 15:07:20 host2 sshd[2204093]: Disconnected from invalid user test 209.141.52.88 port 48780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 15:07:40 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54006: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.34
country_id: 6252001
description:
Dec 24 15:09:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.34, lip=66.85.158.92, session=<Nbmkbq9Gq+bDuEwi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.244
country_id: 6252001
description:
Dec 24 15:09:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.244, lip=66.85.158.92, session=<UXLpb69GzdDDuEz0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.245
country_id: 6252001
description:
Dec 24 15:09:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.245, lip=66.85.158.92, session=<buVPb69G093DuEz1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.247
country_id: 6252001
description:
Dec 24 15:09:28 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.247, lip=66.85.158.92, session=<Jo+5b69Gz5fDuEz3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-24 15:10:43 dovecot_login authenticator failed for H=([186.238.247.238]) [186.238.247.238]:60902: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 15:11:36 host2 sshd[2207552]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-24 15:13:09 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:45353: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-24 15:14:11 dovecot_login authenticator failed for H=([103.251.31.154]) [103.251.31.154]:53556: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-24 15:13:23 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:55092: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-12-24 15:19:23 dovecot_login authenticator failed for H=(177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:34224: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-24 15:19:45 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:37330: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 15:22:33 host2 sshd[2216039]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-24 15:25:49 dovecot_login authenticator failed for H=host-89-242-182-159.as13285.net [89.242.182.159]:48909: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-24 15:26:14 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:57445: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.64.121
country_id: 6252001
description:
[2025-12-24 15:28:15 +0530] info [cpaneld] 72.80.64.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.196.96.136
country_id: 6252001
description:
[2025-12-24 15:28:16 +0530] info [cpaneld] 74.196.96.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.7.28
country_id: 6252001
description:
[2025-12-24 15:28:18 +0530] info [cpaneld] 23.243.7.28 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.26.104.122
country_id: 6252001
description:
[2025-12-24 15:28:20 +0530] info [whostmgrd] 98.26.104.122 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 24 15:28:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<oIUZta9GEMojygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-24 15:28:54 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:48978: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.250.173.134
country_id: 6252001
description:
[2025-12-24 15:28:22 +0530] info [cpaneld] 172.250.173.134 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.239.242.32
country_id: 6252001
description:
[2025-12-24 15:28:25 +0530] info [cpaneld] 141.239.242.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.171.142
country_id: 6252001
description:
[2025-12-24 15:28:23 +0530] info [cpaneld] 104.32.171.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2025-12-24 15:28:36 dovecot_login authenticator failed for H=([49.124.152.234]) [49.124.152.234]:43186: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:34:27 host2 sshd[2224979]: Disconnected from invalid user lisa 193.70.86.193 port 49924 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.27.196.241
country_id: 6252001
description:
[2025-12-24 15:36:43 +0530] info [cpaneld] 50.27.196.241 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.139.15
country_id: 6252001
description:
[2025-12-24 15:36:45 +0530] info [cpaneld] 45.31.139.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.11.4.19
country_id: 6252001
description:
[2025-12-24 15:36:48 +0530] info [cpaneld] 100.11.4.19 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-24 15:37:03 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:38021: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-24 15:36:22 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:59490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.128.42.219
country_id: 6252001
description:
[2025-12-24 15:36:44 +0530] info [whostmgrd] 107.128.42.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.67.162.134
country_id: 6252001
description:
[2025-12-24 15:36:47 +0530] info [cpaneld] 71.67.162.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:36:27 host2 sshd[2226533]: Disconnected from invalid user git 205.185.126.121 port 52820 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.208.87.26
country_id: 6252001
description:
[2025-12-24 15:36:38 +0530] info [cpaneld] 72.208.87.26 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.59.225.11
country_id: 6252001
description:
[2025-12-24 15:36:40 +0530] info [cpaneld] 174.59.225.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.48
country_id: 1733045
description:
2025-12-24 15:37:44 dovecot_login authenticator failed for H=([49.124.151.48]) [49.124.151.48]:32852: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 24 15:38:21 host2 sshd[2227938]: Disconnected from invalid user git 118.193.39.127 port 44956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-24 15:39:14 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:36536: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-24 15:40:05 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:52682: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:39:44 host2 sshd[2228921]: Disconnected from invalid user testuser1 193.70.86.193 port 40176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:39:49 host2 sshd[2229018]: Disconnected from invalid user finance 205.185.126.121 port 36498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:40:39 host2 sshd[2230164]: Disconnected from invalid user gituser 155.248.164.42 port 56690 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.137.56.185
country_id: 6252001
description:
[2025-12-24 15:40:22 +0530] info [cpaneld] 75.137.56.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.132.239.233
country_id: 6252001
description:
[2025-12-24 15:40:21 +0530] info [cpaneld] 99.132.239.233 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.29.184.39
country_id: 6252001
description:
[2025-12-24 15:40:26 +0530] info [whostmgrd] 96.29.184.39 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.218.78.4
country_id: 6252001
description:
[2025-12-24 15:40:31 +0530] info [cpaneld] 32.218.78.4 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 15:41:07 host2 pure-ftpd[2230543]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.150.35
country_id: 6252001
description:
[2025-12-24 15:40:24 +0530] info [cpaneld] 45.50.150.35 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.189.84.53
country_id: 6252001
description:
[2025-12-24 15:40:27 +0530] info [cpaneld] 99.189.84.53 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.96.110.65
country_id: 6252001
description:
[2025-12-24 15:40:29 +0530] info [cpaneld] 98.96.110.65 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-24 15:40:23 dovecot_login authenticator failed for H=([182.95.24.209]) [182.95.57.158]:53040: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Dec 24 15:41:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.11, lip=66.85.158.92, session=<rCCh4a9GT+pb51kL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:41:53 host2 sshd[2230892]: Disconnected from invalid user victor 189.50.142.82 port 44413 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:42:13 host2 sshd[2231252]: Disconnected from invalid user john 205.185.126.121 port 34730 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Dec 24 15:41:33 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.11, lip=66.85.158.92, session=<Sh174q9GO4Bb51kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.14
country_id: 3017382
description:
Dec 24 15:41:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.14, lip=66.85.158.92, session=<rlKt4q9G051b51kO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:41:58 host2 sshd[2230962]: Disconnected from invalid user jose 193.70.86.193 port 38810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:41:27 host2 sshd[2230697]: Disconnected from invalid user asd 193.70.86.193 port 33710 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.134
country_id: 3017382
description:
Dec 24 15:41:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.134, lip=66.85.158.92, session=</9BG4q9Gmcpb51mG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:42:41 host2 sshd[2231578]: Disconnected from invalid user asd 155.248.164.42 port 40856 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:43:19 host2 sshd[2232042]: Disconnected from invalid user seedbox 155.248.164.42 port 34488 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.115.225.163
country_id: 6252001
description:
[2025-12-24 15:44:12 +0530] info [cpaneld] 172.115.225.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.190.217.190
country_id: 6252001
description:
[2025-12-24 15:44:13 +0530] info [whostmgrd] 68.190.217.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.42.7.86
country_id: 6252001
description:
[2025-12-24 15:44:16 +0530] info [cpaneld] 73.42.7.86 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.35.177.21
country_id: 6252001
description:
[2025-12-24 15:44:06 +0530] info [cpaneld] 98.35.177.21 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.52.149.226
country_id: 6252001
description:
[2025-12-24 15:44:10 +0530] info [cpaneld] 170.52.149.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.106.39.203
country_id: 6252001
description:
[2025-12-24 15:44:15 +0530] info [cpaneld] 99.106.39.203 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.89.244.47
country_id: 6252001
description:
[2025-12-24 15:44:18 +0530] info [cpaneld] 167.89.244.47 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.34.105.190
country_id: 6252001
description:
[2025-12-24 15:45:27 +0530] info [cpaneld] 104.34.105.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.213.132.158
country_id: 6252001
description:
[2025-12-24 15:45:29 +0530] info [cpaneld] 107.213.132.158 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.49.41
country_id: 6252001
description:
[2025-12-24 15:45:32 +0530] info [cpaneld] 98.97.49.41 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.218.163
country_id: 6252001
description:
[2025-12-24 15:45:30 +0530] info [whostmgrd] 76.170.218.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.254.83.71
country_id: 6252001
description:
[2025-12-24 15:45:35 +0530] info [cpaneld] 142.254.83.71 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.183.252.199
country_id: 6252001
description:
[2025-12-24 15:45:36 +0530] info [cpaneld] 71.183.252.199 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.199.22.11
country_id: 6252001
description:
[2025-12-24 15:45:26 +0530] info [cpaneld] 98.199.22.11 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.95.173.102
country_id: 6251999
description:
Dec 24 15:46:39 host2 pure-ftpd[2234697]: (?@38.95.173.102) [INFO] New connection from 38.95.173.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.163
country_id: 3996063
description:
2025-12-24 15:46:52 dovecot_login authenticator failed for H=(201.172.88.163-clientes-izzi.mx) [201.172.88.163]:42542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-24 15:47:05 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:50784: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 24 15:48:21 host2 sshd[2237157]: Disconnected from invalid user seedbox 118.193.39.127 port 46980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:49:24 host2 sshd[2238701]: Disconnected from invalid user uftp 189.50.142.82 port 53358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:52:24 host2 sshd[2243029]: Disconnected from invalid user ftpuser 189.50.142.82 port 39256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-24 15:55:11 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:47646: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-12-24 15:55:15 dovecot_login authenticator failed for H=1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:59584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-24 15:55:23 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:39730: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-24 15:55:34 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:35112: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-24 15:58:07 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:53396: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.88.178.214
country_id: 6252001
description:
[2025-12-24 15:59:26 +0530] info [webmaild] 166.88.178.214 - info@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 24 16:04:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<NRu/MrBGEojBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-24 16:14:25 dovecot_login authenticator failed for H=([128.185.229.126]) [128.185.229.126]:51862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.125
country_id: 3469034
description:
Dec 24 16:14:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=177.44.96.125, lip=66.85.158.91, TLS, session=<XfcOWLBGxMqxLGB9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.23
country_id: 690791
description:
Dec 24 16:15:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.25.23, lip=66.85.158.91, TLS, session=<GwE+WbBGVYWwZxkX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-12-24 16:15:04 dovecot_login authenticator failed for H=177-72-87-7.static.as262543.net.br [177.72.87.7]:34212: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-24 16:15:22 dovecot_plain authenticator failed for H=ool-457bdb52.dyn.optonline.net (ozoaccal) [69.123.219.82]:59894: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-24 16:18:36 dovecot_login authenticator failed for H=wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:56095: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-24 16:19:34 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (sphooded) [174.169.224.27]:40190: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.160
country_id: 3469034
description:
Dec 24 16:19:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=191.53.128.160, lip=66.85.158.91, TLS, session=<aUIbarBGSc+/NYCg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.0.14.108
country_id: 6252001
description:
[2025-12-24 16:18:56 +0530] info [cpaneld] 142.0.14.108 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.145.86.81
country_id: 6252001
description:
[2025-12-24 16:18:58 +0530] info [cpaneld] 104.145.86.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.101.255
country_id: 6252001
description:
[2025-12-24 16:19:04 +0530] info [cpaneld] 76.171.101.255 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-12-24 16:19:04 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com [203.198.173.137]:42790: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.219
country_id: 3469034
description:
Dec 24 16:19:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=187.120.73.219, lip=66.85.158.91, TLS, session=<b97oaLBG6827eEnb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.57.233.30
country_id: 6252001
description:
[2025-12-24 16:19:00 +0530] info [cpaneld] 99.57.233.30 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.165.130.42
country_id: 6252001
description:
[2025-12-24 16:19:02 +0530] info [cpaneld] 24.165.130.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.173.30
country_id: 6252001
description:
[2025-12-24 16:19:01 +0530] info [whostmgrd] 173.68.173.30 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.139.193.81
country_id: 6252001
description:
[2025-12-24 16:19:03 +0530] info [cpaneld] 35.139.193.81 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 288 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.57
country_id: 6252001
description:
Dec 24 16:25:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.97.26.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1SSWgLBGqtwSYRo5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.57
country_id: 6252001
description:
Dec 24 16:25:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.26.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Tmb7gLBG4sgSYRo5>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 315 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.157.5
country_id: 6252001
description:
[2025-12-24 16:29:01 +0530] info [cpaneld] 24.4.157.5 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.193.155.156
country_id: 6252001
description:
[2025-12-24 16:29:21 +0530] info [cpaneld] 216.193.155.156 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.254.4.112
country_id: 6252001
description:
[2025-12-24 16:29:24 +0530] info [whostmgrd] 73.254.4.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.244.230.48
country_id: 6252001
description:
[2025-12-24 16:29:27 +0530] info [cpaneld] 71.244.230.48 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.85.101.131
country_id: 6252001
description:
[2025-12-24 16:29:00 +0530] info [cpaneld] 69.85.101.131 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.135.246.242
country_id: 6252001
description:
[2025-12-24 16:29:08 +0530] info [cpaneld] 207.135.246.242 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.235.110.127
country_id: 6252001
description:
[2025-12-24 16:29:31 +0530] info [cpaneld] 98.235.110.127 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.234.166.119
country_id: 6252001
description:
[2025-12-24 16:29:02 +0530] info [whostmgrd] 73.234.166.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.206.18
country_id: 6252001
description:
[2025-12-24 16:29:03 +0530] info [cpaneld] 35.150.206.18 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.38.222.116
country_id: 6252001
description:
[2025-12-24 16:29:20 +0530] info [cpaneld] 100.38.222.116 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.180.57.121
country_id: 6252001
description:
[2025-12-24 16:29:23 +0530] info [cpaneld] 24.180.57.121 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.188.204.197
country_id: 6252001
description:
[2025-12-24 16:28:56 +0530] info [cpaneld] 65.188.204.197 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.130.72.50
country_id: 6252001
description:
[2025-12-24 16:29:06 +0530] info [cpaneld] 107.130.72.50 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.46.29.69
country_id: 6252001
description:
[2025-12-24 16:29:29 +0530] info [cpaneld] 74.46.29.69 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.215.166
country_id: 6252001
description:
[2025-12-24 16:31:16 +0530] info [cpaneld] 73.235.215.166 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.247.205
country_id: 6252001
description:
[2025-12-24 16:31:17 +0530] info [cpaneld] 23.243.247.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.121.242.186
country_id: 6252001
description:
[2025-12-24 16:31:19 +0530] info [whostmgrd] 70.121.242.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.117.116.46
country_id: 6252001
description:
[2025-12-24 16:31:18 +0530] info [cpaneld] 23.117.116.46 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.51.38.144
country_id: 6252001
description:
[2025-12-24 16:31:20 +0530] info [cpaneld] 75.51.38.144 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.242.170
country_id: 6252001
description:
[2025-12-24 16:31:21 +0530] info [cpaneld] 47.147.242.170 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.165.193
country_id: 6252001
description:
[2025-12-24 16:31:22 +0530] info [cpaneld] 67.188.165.193 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:39:44 host2 sshd[2293776]: Disconnected from invalid user miguel 51.222.106.104 port 58166 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.19.186
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.19.186: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:40:35 host2 sshd[2295120]: Disconnected from invalid user build 103.118.114.22 port 39692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:42:09 host2 sshd[2296819]: Disconnected from invalid user samba 51.222.106.104 port 56622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:42:35 host2 sshd[2297208]: Disconnected from invalid user appltest 163.181.207.222 port 49250 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 16:43:43 host2 pure-ftpd[2298314]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:43:57 host2 sshd[2298597]: Disconnected from invalid user ubuntu 103.118.114.22 port 39144 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 322 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:45:07 host2 sshd[2299724]: Disconnected from invalid user tars 51.222.106.104 port 55622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:45:47 host2 sshd[2300310]: Disconnected from invalid user teaspeak 167.71.128.40 port 60500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:46:20 host2 sshd[2301188]: Disconnected from invalid user samba 167.71.128.40 port 56272 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:47:21 host2 sshd[2302049]: Received disconnect from 167.71.128.40 port 36876:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:47:21 host2 sshd[2302049]: Disconnected from invalid user ftpuser 167.71.128.40 port 36876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 24 16:47:32 host2 sshd[2302203]: Disconnected from invalid user spooler 199.195.254.215 port 56536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 24 16:47:56 host2 sshd[2302520]: Disconnected from invalid user test 20.102.116.25 port 43546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:48:14 host2 sshd[2302857]: Disconnected from invalid user gopal 163.181.207.222 port 39076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:48:28 host2 sshd[2303060]: Disconnected from invalid user raaj 103.118.114.22 port 38236 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 24 16:48:31 host2 sshd[2303157]: Disconnected from invalid user tin 20.102.116.25 port 43984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:48:49 host2 sshd[2303443]: Disconnected from invalid user hoster 167.71.128.40 port 53346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:49:09 host2 sshd[2303872]: Disconnected from invalid user tin 163.181.207.222 port 39410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:50:29 host2 sshd[2305228]: Disconnected from invalid user nasrin 163.181.207.222 port 35636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 24 16:50:00 host2 sshd[2304637]: Disconnected from invalid user oracle 213.6.203.226 port 38443 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.79.63
country_id: 6252001
description:
Dec 24 16:50:57 host2 sshd[2305728]: Disconnected from invalid user wm 146.190.79.63 port 42934 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.79.63
country_id: 6252001
description:
Dec 24 16:51:29 host2 sshd[2306459]: Disconnected from invalid user admin 146.190.79.63 port 36700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:51:39 host2 sshd[2306620]: Disconnected from invalid user j 51.222.106.104 port 46874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 24 16:52:42 host2 sshd[2307380]: Disconnected from invalid user wahyu 213.6.203.226 port 61476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:53:20 host2 sshd[2307947]: Disconnected from invalid user wm 163.181.207.222 port 50640 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 16:57:24 host2 sshd[2311615]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-24 17:04:25 dovecot_plain authenticator failed for H=(allatoxyle) [24.104.225.201]:55637: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:05:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<XINuELFGRusDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:07:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<4aSKFLFGEtsDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 17:08:21 host2 sshd[2322614]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-24 17:08:41 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:35896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:09:06 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<pBahG7FGAMIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:10:15 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0si0H7FGDrMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:11:36 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<BgSGJLFGDsgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:12:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<zeLPJrFGdIoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:13:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<oqU/K7FGtOkDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:13:44 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<2/MtLLFGzLQDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.202.200
country_id: 3175395
description:
Dec 24 17:13:46 host2 sshd[2327828]: Disconnected from invalid user test 151.38.202.200 port 34668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.248
country_id: 3865483
description:
Dec 24 17:14:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=186.124.218.248, lip=66.85.158.91, TLS, session=<u1hJL7FGnNW6fNr4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:14:57 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tZKDMLFGGpMDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.139
country_id: 798544
description:
Dec 24 17:15:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.192.179.139, lip=66.85.158.91, TLS, session=<7GR6MLFGLJDBwLOL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:15:53 host2 sshd[2330259]: Disconnected from invalid user ubuntu 195.199.212.141 port 35632 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:16:02 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<PjxtNLFGkpwDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:17:51 host2 sshd[2332114]: Disconnected from invalid user mathias 195.199.212.141 port 42202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:18:27 host2 sshd[2332673]: Disconnected from invalid user wms 195.199.212.141 port 45580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 24 17:18:34 host2 sshd[2332802]: Disconnected from invalid user huawei 68.183.236.1 port 57048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.227.65.179
country_id: 3469034
description:
Dec 24 17:19:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=168.227.65.179, lip=66.85.158.91, TLS, session=</VfMQLFGucmo40Gz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 24 17:19:52 host2 sshd[2334219]: Disconnected from invalid user iptv 68.183.236.1 port 58212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.118
country_id: 690791
description:
Dec 24 17:20:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=194.44.140.118, lip=66.85.158.91, TLS, session=<GAAjQrFGC4HCLIx2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:21:22 host2 sshd[2336140]: Disconnected from invalid user steam 195.199.212.141 port 44522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.202.200
country_id: 3175395
description:
Dec 24 17:21:47 host2 sshd[2336502]: Disconnected from invalid user admin 151.38.202.200 port 34380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:22:37 host2 sshd[2337397]: Disconnected from invalid user test 195.199.212.141 port 42506 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.84.112.17
country_id: 6252001
description:
[2025-12-24 17:24:24 +0530] info [cpaneld] 76.84.112.17 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.118.41.177
country_id: 6252001
description:
[2025-12-24 17:24:26 +0530] info [cpaneld] 23.118.41.177 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.45.194.155
country_id: 6252001
description:
[2025-12-24 17:24:28 +0530] info [whostmgrd] 68.45.194.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.216.99.101
country_id: 6252001
description:
[2025-12-24 17:24:27 +0530] info [cpaneld] 69.216.99.101 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.147.254.109
country_id: 6252001
description:
[2025-12-24 17:24:30 +0530] info [cpaneld] 98.147.254.109 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.116.41.147
country_id: 6252001
description:
[2025-12-24 17:24:31 +0530] info [cpaneld] 23.116.41.147 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.19.222.178
country_id: 6252001
description:
[2025-12-24 17:24:32 +0530] info [cpaneld] 149.19.222.178 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.38.202.200
country_id: 3175395
description:
Dec 24 17:25:15 host2 sshd[2340012]: Disconnected from invalid user wms 151.38.202.200 port 34446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.145.167
country_id: 798544
description:
Dec 24 17:25:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=78.31.145.167, lip=66.85.158.91, TLS, session=<AVxIVbFGMsFOH5Gn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-24 17:25:48 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:53078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.122.204
country_id: 690791
description:
Dec 24 17:25:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=91.228.122.204, lip=66.85.158.91, TLS, session=<PbdUVrFGJ+pb5HrM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.138.188
country_id: 3175395
description:
Dec 24 17:29:51 host2 sshd[2344892]: Disconnected from invalid user uap 151.43.138.188 port 2721 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-24 17:34:28 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:50385: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-24 17:34:55 dovecot_login authenticator failed for H=(177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:58643: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-24 17:36:27 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:40014: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 24 17:36:17 host2 sshd[2353570]: Disconnected from invalid user fastuser 68.233.116.124 port 32410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 24 17:37:43 host2 sshd[2355484]: Disconnected from invalid user javier 68.233.116.124 port 60462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.138.188
country_id: 3175395
description:
Dec 24 17:37:54 host2 sshd[2355684]: Disconnected from invalid user ubuntu 151.43.138.188 port 2983 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 24 17:38:27 host2 sshd[2356295]: Disconnected from invalid user ubuntu 68.233.116.124 port 17768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 24 17:38:40 host2 sshd[2356515]: Disconnected from invalid user oleg 38.137.11.10 port 49190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-24 17:39:38 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:39476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Dec 24 17:40:28 host2 sshd[2358457]: Disconnected from invalid user oleg 77.87.40.114 port 41046 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 24 17:40:00 host2 sshd[2357697]: Disconnected from invalid user odoo12 38.137.11.10 port 51429 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.209
country_id: 690791
description:
2025-12-24 17:40:26 H=([77.83.39.209]) [77.83.39.209]:63009 F=<dpr@priv8shop.com> rejected RCPT <davebruce06@outlook.com>: Sender verify failed


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 24 17:40:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<EhhcjbFGxOQjygmF>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.209
country_id: 690791
description:
2025-12-24 17:42:21 H=([77.83.39.209]) [77.83.39.209]:57739 F=<dpr@priv8shop.com> rejected RCPT <davebruce06@outlook.com>: Sender verify failed


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 77.87.40.114
country_id: 690791
description:
Dec 24 17:43:44 host2 sshd[2361643]: Received disconnect from 77.87.40.114 port 58788:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.87.40.114
country_id: 690791
description:
Dec 24 17:45:22 host2 sshd[2363422]: Disconnected from invalid user prometheus 77.87.40.114 port 39432 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.101.134.7
country_id: 6252001
description:
[2025-12-24 17:46:38 +0530] info [cpaneld] 172.101.134.7 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.114.128.199
country_id: 6252001
description:
[2025-12-24 17:46:39 +0530] info [whostmgrd] 68.114.128.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.206.168.138
country_id: 6252001
description:
[2025-12-24 17:46:42 +0530] info [cpaneld] 107.206.168.138 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 17:46:17 host2 pure-ftpd[2364456]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.83.38.168
country_id: 6252001
description:
[2025-12-24 17:46:35 +0530] info [cpaneld] 74.83.38.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.72.115.141
country_id: 6252001
description:
[2025-12-24 17:46:37 +0530] info [cpaneld] 75.72.115.141 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.248.93.166
country_id: 6252001
description:
[2025-12-24 17:46:41 +0530] info [cpaneld] 216.248.93.166 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.101.100.162
country_id: 6252001
description:
[2025-12-24 17:46:43 +0530] info [cpaneld] 73.101.100.162 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Dec 24 17:47:26 host2 sshd[2365880]: Disconnected from invalid user sonic 77.87.40.114 port 60662 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.2
country_id: 798549
description:
Dec 24 17:49:02 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.2, lip=66.85.158.92, TLS, session=<ouRuqrFGTLVV2YwC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 24 17:50:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.92, session=<uH44rrFGOutV2YwD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.194.123
country_id: 6252001
description:
Dec 24 17:50:09 host2 pure-ftpd[2369023]: (?@20.65.194.123) [INFO] New connection from 20.65.194.123


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.234
country_id: 6252001
description:
Dec 24 17:51:29 host2 pure-ftpd[2370686]: (?@40.124.173.234) [INFO] New connection from 40.124.173.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-24 17:52:12 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:48626: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 24 17:53:35 host2 sshd[2372609]: Disconnected from invalid user rust 88.147.30.59 port 47936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.182
country_id: 3865483
description:
Dec 24 17:57:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=179.0.251.182, lip=66.85.158.91, TLS, session=<jGemx7FGzbOzAPu2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.202
country_id: 3469034
description:
Dec 24 17:57:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=191.53.107.202, lip=66.85.158.91, TLS, session=<shpcxrFGEYi/NWvK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 24 17:57:55 host2 sshd[2377144]: Disconnected from invalid user minecraft 88.147.30.59 port 35234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-24 17:59:20 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:46804: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-24 17:58:54 dovecot_login authenticator failed for H=(187.161.136.37-clientes-izzi.mx) [187.161.136.37]:43740: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 24 17:58:59 host2 sshd[2378144]: Disconnected from invalid user barbara 88.147.30.59 port 53595 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 24 17:59:59 host2 sshd[2378957]: Disconnected from invalid user kdk 88.147.30.59 port 43549 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.19
country_id: 3175395
description:
Dec 24 18:02:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=217.26.179.19, lip=66.85.158.91, TLS, session=<JsRO2bFGr+HZGrMT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.39
country_id: 3469034
description:
Dec 24 18:02:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.11.251.39, lip=66.85.158.91, TLS, session=<wnpr2rFGzLaxC/sn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2025-12-24 18:03:40 dovecot_login authenticator failed for H=([113.203.205.37]) [113.203.205.37]:44047: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-12-24 18:03:49 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:42655: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2025-12-24 18:04:32 dovecot_login authenticator failed for H=(abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:3828: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2025-12-24 18:03:54 dovecot_login authenticator failed for H=(nsg-static-233.166.76.182-airtel.com) [182.95.125.122]:42040: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-24 18:04:06 dovecot_login authenticator failed for H=([152.52.204.27]) [128.185.254.162]:37030: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-24 18:04:22 dovecot_login authenticator failed for H=(cm-84.211.13.69.get.no) [84.211.13.69]:57913: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-24 18:10:19 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:41178: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-24 18:09:55 dovecot_login authenticator failed for H=([182.78.10.145]) [122.185.101.50]:58220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.41.48.79
country_id: 6252001
description:
[2025-12-24 18:13:47 +0530] info [cpaneld] 99.41.48.79 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.71.181.252
country_id: 6252001
description:
[2025-12-24 18:13:55 +0530] info [cpaneld] 208.71.181.252 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-24 18:14:17 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:60453: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.146.216
country_id: 3625428
description:
2025-12-24 18:13:28 dovecot_plain authenticator failed for H=([31.57.166.48]) [143.105.146.216]:22057: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.9.55.101
country_id: 6252001
description:
[2025-12-24 18:13:41 +0530] info [cpaneld] 73.9.55.101 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.23.51.161
country_id: 6252001
description:
[2025-12-24 18:13:43 +0530] info [cpaneld] 24.23.51.161 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.147.178
country_id: 6252001
description:
[2025-12-24 18:13:49 +0530] info [whostmgrd] 172.59.147.178 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.95.24
country_id: 6252001
description:
[2025-12-24 18:13:51 +0530] info [cpaneld] 71.30.95.24 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.114.162.27
country_id: 6252001
description:
[2025-12-24 18:13:52 +0530] info [cpaneld] 172.114.162.27 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.152.151.10
country_id: 3469034
description:
2025-12-24 18:16:17 dovecot_plain authenticator failed for H=([31.57.166.48]) [177.152.151.10]:65198: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.80.160.196
country_id: 102358
description:
2025-12-24 18:16:29 dovecot_plain authenticator failed for H=([31.57.166.48]) [178.80.160.196]:33546: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.161.182.16
country_id: 290291
description:
2025-12-24 18:16:43 dovecot_plain authenticator failed for H=109-161-182-16.rev.bb.zain.com ([31.57.166.48]) [109.161.182.16]:54212: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 24 18:16:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<ETZiDbJGGJKLonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:23:07 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=</zZQJLJGYrQDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-24 18:23:58 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:46155: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-24 18:24:07 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:35821: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:23:32 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<oWPOJbJGvtcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:25:10 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<H6+oK7JGMogDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.78.211.68
country_id: 3996063
description:
2025-12-24 18:25:11 dovecot_plain authenticator failed for H=([31.57.166.48]) [170.78.211.68]:52856: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.222.189.212
country_id: 3469034
description:
2025-12-24 18:25:24 dovecot_plain authenticator failed for H=([31.57.166.48]) [179.222.189.212]:6067: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.222.189.212
country_id: 3469034
description:
2025-12-24 18:25:31 dovecot_login authenticator failed for H=([31.57.166.48]) [179.222.189.212]:6067: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.178.13.157
country_id: 3865483
description:
2025-12-24 18:25:37 dovecot_plain authenticator failed for H=([31.57.166.48]) [190.178.13.157]:60699: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:25:38 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<j8JLLbJGGoQDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-24 18:26:52 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:38172: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-24 18:27:05 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:29490: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:26:42 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<hA0hMbJGDpsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:28:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<mJ3NNrJGWNMDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:28:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<c6kaOLJGAJsDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:29:50 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<xFdNPLJGPqgDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 18:30:11 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53429: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:30:30 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<//uvPrJGQMADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.214.55.230
country_id: 798544
description:
Dec 24 18:31:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.214.55.230, lip=66.85.158.92, session=<XPLqQLJGFphf1jfm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 24 18:33:37 host2 pure-ftpd[2411396]: (?@66.132.153.120) [INFO] New connection from 66.132.153.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-24 18:34:31 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:36592: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-12-24 18:34:49 dovecot_login authenticator failed for H=([45.194.15.228]) [45.194.15.228]:48945: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-24 18:35:49 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:39108: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.142
country_id: 3175395
description:
2025-12-24 18:36:24 dovecot_login authenticator failed for H=95-210-105-142.ip.skylogicnet.com [95.210.105.142]:56668: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-24 18:41:07 dovecot_login authenticator failed for H=(201.172.89.74-clientes-izzi.mx) [201.172.89.74]:45697: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2025-12-24 18:41:44 dovecot_login authenticator failed for H=([197.251.249.72]) [197.251.249.72]:41257: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.17
country_id: 3175395
description:
Dec 24 18:45:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.170.17, lip=66.85.158.91, TLS, session=<DLJ3crJGueS5D6oR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.7.79
country_id: 2395170
description:
Dec 24 18:45:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=41.74.7.79, lip=66.85.158.91, TLS, session=<Fjyrc7JGWcIpSgdP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 18:48:57 host2 pure-ftpd[2425285]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.89.85
country_id: 1880251
description:
Dec 24 19:05:20 host2 sshd[2438760]: Disconnected from invalid user webuser 159.223.89.85 port 36274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.89.85
country_id: 1880251
description:
Dec 24 19:06:40 host2 sshd[2439655]: Disconnected from invalid user zhangyue 159.223.89.85 port 50420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.55.168
country_id: 6252001
description:
Dec 24 19:06:47 host2 sshd[2439729]: Disconnected from invalid user afa 64.225.55.168 port 58270 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.55.168
country_id: 6252001
description:
Dec 24 19:09:32 host2 sshd[2441581]: Disconnected from invalid user richard 64.225.55.168 port 35254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-24 19:12:29 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:55039: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 19:13:24 host2 sshd[2444550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-24 19:12:43 dovecot_login authenticator failed for H=(cm-84.214.63.110.get.no) [84.214.63.110]:50260: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Dec 24 19:19:25 host2 sshd[2449379]: Disconnected from invalid user infra 20.203.42.204 port 47206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-24 19:20:31 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:41947: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 24 19:20:39 host2 sshd[2450461]: Disconnected from invalid user design 20.203.42.204 port 42032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-24 19:21:19 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:45150: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 19:24:24 host2 sshd[2453300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-24 19:25:49 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:59414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-24 19:26:06 dovecot_login authenticator failed for H=(201.173.250.36-clientes-izzi.mx) [201.173.250.36]:59338: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.100
country_id: 1269750
description:
Dec 24 19:30:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.18.166.100, lip=66.85.158.91, TLS, session=<kZKoFbNGrepnEqZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.133
country_id: 2300660
description:
Dec 24 19:31:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=41.139.47.133, lip=66.85.158.91, TLS, session=<47oRF7NGhIspiy+F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Dec 24 19:33:29 host2 sshd[2462527]: Disconnected from invalid user josh 103.143.238.173 port 43066 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 166.0.106.131
country_id: 6251999
description:
Dec 24 19:32:32 host2 pure-ftpd[2461329]: (?@166.0.106.131) [INFO] New connection from 166.0.106.131


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.173
country_id: 1819730
description:
Dec 24 19:34:09 host2 sshd[2463260]: Disconnected from invalid user jira 103.143.238.173 port 60214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.78.64
country_id: 690791
description:
Dec 24 19:34:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=194.44.78.64, lip=66.85.158.91, TLS, session=<xj2BIbNGi7bCLE5A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.106.161.226
country_id: 783754
description:
Dec 24 19:33:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=79.106.161.226, lip=66.85.158.91, TLS, session=<XwBRILNGTNNPaqHi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.63.62.103
country_id: 895949
description:
Dec 24 19:36:29 host2 sshd[2466097]: Disconnected from invalid user qa 41.63.62.103 port 53296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.63.62.103
country_id: 895949
description:
Dec 24 19:37:22 host2 sshd[2466944]: Disconnected from invalid user local 41.63.62.103 port 55452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.63.62.103
country_id: 895949
description:
Dec 24 19:38:57 host2 sshd[2468532]: Disconnected from invalid user mahesh 41.63.62.103 port 41884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.17
country_id: 3175395
description:
Dec 24 19:43:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.17, lip=66.85.158.91, TLS, session=<s8bNQ7NGdo25D6kR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.148
country_id: 3996063
description:
Dec 24 19:44:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=138.122.97.148, lip=66.85.158.91, TLS, session=<+EkFRbNGNJSKemGU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.203.8.57
country_id: 294640
description:
[2025-12-24 19:47:06 +0530] info [webmaild] 193.203.8.57 - info@askinternationalconsortium.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2025-12-24 19:48:31 +0530] info [cpaneld] 85.215.116.20 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.42
country_id: 2750405
description:
Dec 24 19:48:45 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 4 secs): user=<>, rip=86.54.31.42, lip=66.85.158.91, session=<WIOKVrNGArFWNh8q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.42
country_id: 2750405
description:
Dec 24 19:48:48 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.42, lip=66.85.158.91, session=<J/e9VrNGGr5WNh8q>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 19:51:48 host2 pure-ftpd[2483521]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.1
country_id: 3175395
description:
Dec 24 19:52:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.171.1, lip=66.85.158.91, TLS, session=<XAJCYbNGVeC5D6sB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.56
country_id: 3469034
description:
Dec 24 19:52:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=187.120.76.56, lip=66.85.158.91, TLS, session=<TAeSYrNGdqW7eEw4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-12-24 19:54:10 dovecot_login authenticator failed for H=([217.33.89.47]) [217.33.89.47]:58039: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-24 19:54:23 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:48108: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.236
country_id: 2635167
description:
Dec 24 19:59:14 host2 pure-ftpd[2491325]: (?@87.236.176.236) [INFO] New connection from 87.236.176.236


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.59
country_id: 798544
description:
Dec 24 20:06:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.246.209.59, lip=66.85.158.91, TLS, session=<T5Xuk7NGF4Fb9tE7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.216
country_id: 3469034
description:
Dec 24 20:06:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=187.120.73.216, lip=66.85.158.91, TLS, session=<bbCxlbNGYIS7eEnY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.162.195
country_id: 1643084
description:
Dec 24 20:06:46 host2 sshd[2498298]: Disconnected from invalid user abhi 36.64.162.195 port 40592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 24 20:07:34 host2 sshd[2499023]: Disconnected from invalid user elasticsearch 43.154.195.142 port 46760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 24 20:09:13 host2 sshd[2500474]: Disconnected from invalid user guest 209.141.33.240 port 55048 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.162.195
country_id: 1643084
description:
Dec 24 20:09:20 host2 sshd[2500561]: Disconnected from invalid user guest 36.64.162.195 port 35254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.162.195
country_id: 1643084
description:
Dec 24 20:08:39 host2 sshd[2499979]: Disconnected from invalid user developer 36.64.162.195 port 45828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Dec 24 20:08:51 host2 sshd[2500124]: Disconnected from invalid user userm 117.247.111.70 port 13838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.113.114.67
country_id: 1269750
description:
Dec 24 20:10:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.113.114.67, lip=66.85.158.91, TLS, session=<ytnforNG/JtncXJD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Dec 24 20:09:35 host2 sshd[2500766]: Disconnected from invalid user newuser 117.247.111.70 port 30410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.12
country_id: 3469034
description:
Dec 24 20:10:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.131.12, lip=66.85.158.91, TLS, session=<hWMWpLNGeYa/NYMM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:10:50 host2 sshd[2502347]: Disconnected from invalid user vyos 189.223.223.96 port 55104 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.247.111.70
country_id: 1269750
description:
Dec 24 20:10:58 host2 sshd[2502419]: Disconnected from invalid user developer 117.247.111.70 port 17322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 24 20:11:14 host2 sshd[2502640]: Disconnected from invalid user dev 36.66.16.233 port 44428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 24 20:11:57 host2 sshd[2503110]: Disconnected from invalid user ftpuser 43.154.195.142 port 33962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.25.51
country_id: 1605651
description:
Dec 24 20:13:51 host2 sshd[2504415]: Disconnected from invalid user david 49.228.25.51 port 34918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 24 20:13:58 host2 sshd[2504497]: Disconnected from invalid user userm 209.141.33.240 port 53330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 24 20:14:03 host2 sshd[2504592]: Disconnected from invalid user panfeng 36.66.16.233 port 41154 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 24 20:15:04 host2 sshd[2505454]: Disconnected from invalid user panfeng 209.141.33.240 port 54892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 24 20:14:52 host2 sshd[2505150]: Disconnected from invalid user user 36.66.16.233 port 54464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.25.51
country_id: 1605651
description:
Dec 24 20:15:51 host2 sshd[2506112]: Disconnected from invalid user developer 49.228.25.51 port 33536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-24 20:16:27 dovecot_login authenticator failed for H=(201.173.216.62-clientes-izzi.mx) [201.173.216.62]:50243: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:15:35 host2 sshd[2505967]: Disconnected from invalid user ansible 189.223.223.96 port 57504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 24 20:15:38 host2 sshd[2505978]: Disconnected from invalid user zk 43.154.195.142 port 40608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.25
country_id: 298795
description:
2025-12-24 20:16:55 dovecot_login authenticator failed for H=([188.59.178.25]) [188.59.178.25]:32980: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:17:51 host2 sshd[2507515]: Disconnected from invalid user sftpuser 189.223.223.96 port 7786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:20:04 host2 sshd[2509257]: Disconnected from invalid user lsk 189.223.223.96 port 54846 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.58
country_id: 6252001
description:
Dec 24 20:20:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.149.58, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Tncsx7NGGtui2JU6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.58
country_id: 6252001
description:
Dec 24 20:21:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.58, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<zzlyyrNG7Pii2JU6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-24 20:22:05 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:40844: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:22:12 host2 sshd[2511149]: Disconnected from invalid user runner 189.223.223.96 port 39401 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-24 20:23:01 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:54056: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.58
country_id: 6252001
description:
Dec 24 20:27:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.58, lip=66.85.158.92, TLS, session=<LgyF37NGLPai2JU6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:31:15 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.91, session=<3uyM7rNGFIWSExg5>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.189.19.148
country_id: 2635167
description:
Dec 24 20:31:52 host2 pure-ftpd[2519991]: (?@206.189.19.148) [INFO] New connection from 206.189.19.148


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:36:54 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.92, session=<pVa/ArRGxtuSExg5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-24 20:37:00 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:56460: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec 24 20:38:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<T6mRCLRG3qm4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-24 20:41:31 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:46274: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.82
country_id: 3865483
description:
Dec 24 20:44:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.251.82, lip=66.85.158.91, TLS, session=<xpaMG7RG78uzAPtS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.29.66
country_id: 933860
description:
Dec 24 20:44:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=83.143.29.66, lip=66.85.158.91, TLS, session=<slPaHLRG+99Tjx1C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec 24 20:46:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<KCc2JrRG1v7CpRCn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:49:09 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.91, session=<x2qLLrRGasySExg5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.83.27.33
country_id: 241170
description:
Dec 24 20:49:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=154.83.27.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uZ7+L7RGAJGaUxsh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.106
country_id: 953987
description:
Dec 24 20:50:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=102.64.40.106, lip=66.85.158.91, TLS, session=<mWjMMLRGudNmQChq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.131
country_id: 6252001
description:
Dec 24 20:50:20 host2 pure-ftpd[2540927]: (?@198.235.24.131) [INFO] New connection from 198.235.24.131


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.216.135.138
country_id: 1168579
description:
Dec 24 20:50:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=103.216.135.138, lip=66.85.158.91, TLS, session=<nwYhMrRGn99n2IeK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:54:10 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.91, session=<sZB6QLRGcs6SExg5>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 20:54:32 host2 pure-ftpd[2546120]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:56:21 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.91, session=<ZDpJSLRGNomSExg5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.173
country_id: 3175395
description:
Dec 24 20:56:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.197.9.173, lip=66.85.158.91, TLS, session=<5O1YR7RGuaK5xQmt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.16.169
country_id: 2300660
description:
Dec 24 20:56:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.211.16.169, lip=66.85.158.91, TLS, session=<jbaDSLRGAegp0xCp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 20:58:42 host2 sshd[2549736]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-24 21:02:43 dovecot_login authenticator failed for H=([152.52.246.198]) [152.52.246.198]:52164: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2025-12-24 21:03:16 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:39867: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-24 21:03:49 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:56122: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-24 21:04:13 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:39000: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.40.73.133
country_id: 6252001
description:
[2025-12-24 21:05:18 +0530] info [webmaild] 216.40.73.133 - info@agentallianz.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@agentallianz.com has their account suspended. Login blocked.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.100
country_id: 2328926
description:
Dec 24 21:05:39 host2 pure-ftpd[2555773]: (?@102.204.223.100) [INFO] New connection from 102.204.223.100


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.9.19.90
country_id: 2782113
description:
[2025-12-24 21:08:35 +0530] info [webmaild] 185.9.19.90 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 21:09:42 host2 sshd[2559115]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-24 21:11:38 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:47297: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.42.210.18
country_id: 1880251
description:
Dec 24 21:14:22 host2 pure-ftpd[2563344]: (?@152.42.210.18) [INFO] New connection from 152.42.210.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-12-24 21:14:58 dovecot_login authenticator failed for H=([177.239.160.3]) [177.239.160.3]:46421: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-24 21:15:27 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:45561: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.205.186.84
country_id: 146669
description:
[2025-12-24 21:21:16 +0530] info [webmaild] 185.205.186.84 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-24 21:23:46 dovecot_login authenticator failed for H=h77-53-110-11.cust.bredband2.com [77.53.110.11]:41878: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-24 21:26:29 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:49686: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-24 21:26:57 dovecot_login authenticator failed for H=([125.18.28.146]) [125.17.185.94]:58344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-24 21:29:00 dovecot_login authenticator failed for H=(189.219.138.45-clientes-izzi.mx) [189.219.138.45]:59761: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-24 21:29:26 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:33146: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.205
country_id: 6252001
description:
Dec 24 21:32:57 host2 pure-ftpd[2579478]: (?@205.210.31.205) [INFO] New connection from 205.210.31.205


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Dec 24 21:40:08 host2 pure-ftpd[2586146]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-24 21:40:48 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:40914: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-12-24 21:41:42 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com [82.209.148.60]:50700: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-24 21:45:08 dovecot_login authenticator failed for H=([120.157.6.147]) [120.157.6.147]:42934: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 21:45:19 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52844: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.108
country_id: 1733045
description:
2025-12-24 21:45:23 dovecot_login authenticator failed for H=([49.124.147.108]) [49.124.147.108]:34432: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Dec 24 21:55:06 host2 sshd[2613485]: Disconnected from invalid user nominatim 20.255.62.58 port 37656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-24 21:56:13 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:47762: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.24
country_id: 6252001
description:
Dec 24 21:56:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.24, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RvN/H7VGNMSi2JUY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 21:57:01 host2 pure-ftpd[2615657]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-24 21:56:28 dovecot_login authenticator failed for H=(nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:42990: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.24
country_id: 6252001
description:
Dec 24 21:57:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.149.24, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Z3T/IrVGPP+i2JUY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 24 21:57:34 host2 sshd[2616250]: Disconnected from invalid user xyx 24.144.124.91 port 57608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 24 21:59:32 host2 sshd[2617953]: Disconnected from invalid user intern 24.144.124.91 port 54240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.255.62.58
country_id: 1819730
description:
Dec 24 22:00:35 host2 sshd[2619066]: Disconnected from invalid user sebas 20.255.62.58 port 48256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.62.150
country_id: 6252001
description:
Dec 24 22:01:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=66.228.62.150, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<SeS2MrVGqdpC5D6W>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.24
country_id: 6252001
description:
Dec 24 22:04:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.24, lip=66.85.158.91, TLS, session=<Axu7PLVGjP+i2JUY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 24 22:06:12 host2 sshd[2623950]: Disconnected from invalid user hadi 5.182.83.231 port 35080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 24 22:07:13 host2 sshd[2624850]: Disconnected from invalid user vboxuser 5.182.83.231 port 55946 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 24 22:08:13 host2 sshd[2625873]: Disconnected from invalid user postgres 5.182.83.231 port 48632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-24 22:10:05 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:44788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 24 22:10:13 host2 sshd[2627973]: Disconnected from invalid user terraria 5.182.83.231 port 53820 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 24 22:10:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<SxXHT7VGqB7UZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 24 22:11:07 host2 sshd[2628826]: Disconnected from invalid user sebas 24.144.124.91 port 46720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-24 22:10:25 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:32882: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-24 22:12:48 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:53763: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-24 22:12:54 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:59155: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-24 22:13:23 dovecot_login authenticator failed for H=([121.73.162.242]) [121.73.162.242]:33000: 535 Incorrect authentication data (set_id=marketing)


