# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 08:37:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<flfiqSJHwJCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 08:37:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dDwoqiJH8Lgv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-30 08:38:20 dovecot_plain authenticator failed for H=(geonally) [24.104.225.201]:37065: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-12-30 08:39:15 dovecot_login authenticator failed for H=(static-200-85-150173.vnet.bo) [200.85.150.173]:36184: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 30 08:42:37 host2 sshd[1455888]: Disconnected from invalid user andrey 202.157.177.33 port 51446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.248.183
country_id: 1269750
description:
2025-12-30 08:43:47 dovecot_plain authenticator failed for H=(6S73LVD8) [49.43.248.183]:59061: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 08:46:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<M2VlxyJHZpd100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.204.63.118
country_id: 2300660
description:
Dec 30 08:46:45 host2 sshd[1461260]: Disconnected from invalid user strapi 41.204.63.118 port 48922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 30 08:46:14 host2 sshd[1460918]: Disconnected from invalid user partner 23.242.166.38 port 52878 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 08:46:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<9YSdyCJHWJWElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 30 08:47:21 host2 sshd[1462158]: Disconnected from invalid user git 23.242.166.38 port 46952 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 30 08:48:29 host2 sshd[1463075]: Disconnected from invalid user josue 23.242.166.38 port 43070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 30 08:48:36 host2 sshd[1463145]: Disconnected from invalid user ubuntu 202.157.177.33 port 55078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.179.188.92
country_id: 6252001
description:
Dec 30 08:48:58 host2 sshd[1463543]: Disconnected from invalid user dev 66.179.188.92 port 47310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.179.188.92
country_id: 6252001
description:
Dec 30 08:49:35 host2 sshd[1464032]: Disconnected from invalid user www 66.179.188.92 port 47560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 08:51:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<XaF12SJHiM5n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 08:50:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xec11yJHlI4v+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.204.63.118
country_id: 2300660
description:
Dec 30 08:50:43 host2 sshd[1465092]: Disconnected from invalid user ftp_user 41.204.63.118 port 37038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.91.16.47
country_id: 1880251
description:
Dec 30 08:50:45 host2 sshd[1465131]: Disconnected from invalid user admin 111.91.16.47 port 53322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.204.63.118
country_id: 2300660
description:
Dec 30 08:52:02 host2 sshd[1465913]: Disconnected from invalid user www 41.204.63.118 port 35812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 08:51:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Z5D32SJHzIcyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 08:54:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<cChQ5CJH+sKeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.130.212.59
country_id: 1643084
description:
2025-12-30 08:55:42 dovecot_login authenticator failed for H=([222.124.249.133]) [203.130.212.59]:50632: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 08:55:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<6dQA6yJHyplCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-30 08:56:00 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:64763: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Dec 30 08:56:05 host2 sshd[1469920]: Disconnected from invalid user test 85.133.237.167 port 39392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 08:55:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Iz9r6CJH9slnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.86.4
country_id: 6252001
description:
Dec 30 08:56:44 host2 sshd[1470468]: Disconnected from invalid user orca 198.12.86.4 port 52004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-12-30 08:57:27 dovecot_login authenticator failed for H=([65.20.250.180]) [65.20.250.180]:54287: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-30 08:57:55 dovecot_login authenticator failed for H=([182.95.178.122]) [182.95.178.122]:44456: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.86.4
country_id: 6252001
description:
Dec 30 08:58:15 host2 sshd[1471641]: Disconnected from invalid user denis 198.12.86.4 port 58966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.97.24.41
country_id: 732800
description:
Dec 30 09:00:05 host2 sshd[1473617]: Disconnected from invalid user administrator 83.97.24.41 port 58408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.77
country_id: 3469034
description:
Dec 30 09:00:32 host2 sshd[1474231]: Disconnected from invalid user mmm 189.47.10.77 port 45942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Dec 30 09:00:38 host2 sshd[1474309]: Disconnected from invalid user vlad 85.133.237.167 port 38508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.86.4
country_id: 6252001
description:
Dec 30 09:00:42 host2 sshd[1474373]: Disconnected from invalid user administrator 198.12.86.4 port 32910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.97.24.41
country_id: 732800
description:
Dec 30 09:01:11 host2 sshd[1474808]: Disconnected from invalid user ss 83.97.24.41 port 41016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 09:01:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<25sT/iJHqSVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 30 09:01:23 host2 sshd[1475054]: Disconnected from invalid user odoo 110.164.228.242 port 36832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 30 09:02:47 host2 sshd[1476162]: Disconnected from invalid user test 110.164.228.242 port 32776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.196
country_id: 1643084
description:
Dec 30 09:02:10 host2 sshd[1475649]: Disconnected from invalid user administrator 103.187.146.196 port 54000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 09:02:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<B73VASNHzKGi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.237.167
country_id: 130758
description:
Dec 30 09:02:45 host2 sshd[1476131]: Disconnected from invalid user newuser 85.133.237.167 port 55586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 09:03:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ERaYBiNHGK4jupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.196
country_id: 1643084
description:
Dec 30 09:04:05 host2 sshd[1477365]: Disconnected from invalid user mika 103.187.146.196 port 60296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.196
country_id: 1643084
description:
Dec 30 09:03:25 host2 sshd[1476827]: Disconnected from invalid user talha 103.187.146.196 port 42390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-30 09:05:46 dovecot_login authenticator failed for H=([103.163.44.118]) [103.163.44.118]:44012: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 09:07:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Zds/EyNHxNKeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-30 09:07:49 dovecot_plain authenticator failed for H=(shlobefett) [199.192.123.12]:46506: 535 Incorrect authentication data (set_id=admin@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-30 09:07:52 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (unally) [76.97.155.25]:32892: 535 Incorrect authentication data (set_id=admin@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.77
country_id: 3469034
description:
Dec 30 09:08:44 host2 sshd[1482096]: Disconnected from invalid user test 189.47.10.77 port 58292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-30 09:08:19 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (untaness) [73.183.74.177]:41716: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 09:10:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<gn8zHyNHcoYvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-30 09:13:29 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:52690: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-12-30 09:14:10 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:62803: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 09:15:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<QTYVMCNHvt1V6odu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 09:16:11 host2 sshd[1488484]: Disconnected from invalid user admin 2.57.121.112 port 22905 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 09:17:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<cm8yNyNHRJ+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 09:18:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<PUHOOyNHhIIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 09:20:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<U/oVQSNHVqCYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 09:20:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Dxo/QyNH9Jkv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 09:20:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<lRNjRCNH3oQzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-30 09:22:48 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:41306: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-30 09:23:03 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:60094: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 09:23:14 host2 sshd[1495235]: Disconnected from invalid user user 2.57.121.25 port 29970 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.235
country_id: 6252001
description:
Dec 30 09:24:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.235, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<5qYPUSNHB92i2Jbr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 09:24:52 host2 sshd[1496613]: Disconnected from invalid user beatrice 62.60.131.157 port 40688 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 09:25:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<E9RbVCNHUu0zTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.235
country_id: 6252001
description:
Dec 30 09:25:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.235, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<EwxoVCNHQuOi2Jbr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 09:26:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<FZUQWSNHnrcFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:29:07 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<fmmhYSNHzNcDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 09:29:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gwxhYyNHEr+i8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:30:06 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<ogojZSNHyMYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:30:53 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<TI7xZyNH1OYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:31:43 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<V4XkaiNHJusDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.235
country_id: 6252001
description:
Dec 30 09:31:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.235, lip=66.85.158.92, TLS, session=<0vBraSNHKvSi2Jbr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:32:44 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<Kl2ObiNHnssDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-30 09:34:03 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:36390: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:34:07 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<3AKAcyNHGK8DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-30 09:34:25 dovecot_login authenticator failed for H=(73-161-97-62.cust.smartcall.no) [62.97.161.73]:53077: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 09:34:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<o5lQdiNHDrho7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:35:04 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<phbpdiNH+oMDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:36:04 host2 dovecot[512723]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<oTp9eiNHMrADlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 09:35:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N+FodyNHzMCeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 09:35:24 host2 pure-ftpd[1507251]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:35:29 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<9vleeCNHnJsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:36:25 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<YM++eyNH2OcDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:36:59 host2 dovecot[512723]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<H7PEfSNH1MkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:38:03 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<4q+KgSNHiNADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:38:47 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<DNg2hCNHNNgDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 09:40:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Qm94iyNHupmnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 09:42:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7I0HkCNHKKAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 09:42:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fxM7kCNHrzJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.0.250.125
country_id: 3469034
description:
Dec 30 09:43:10 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=170.0.250.125, lip=66.85.158.91, TLS, session=<XaLWkiNH0pSqAPp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.201
country_id: 2300660
description:
Dec 30 09:43:30 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.47.201, lip=66.85.158.91, TLS, session=<UND7kyNH254piy/J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 09:44:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ySUVmSNHntwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 09:45:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<uLobmyNHUrBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-30 09:46:02 dovecot_plain authenticator failed for H=c-76-106-163-189.hsd1.fl.comcast.net (prehotion) [76.106.163.189]:34330: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 09:48:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+ceKpyNHXoVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Dec 30 09:49:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<ifqmqyNHEK3E+2YP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 09:53:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dY2suCNHdAhniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 09:53:45 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62147: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-30 09:55:20 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:60243: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 09:55:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<g1K9vyNH4uSElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
country_id: 1269750
description:
2025-12-30 09:55:36 dovecot_login authenticator failed for H=(nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:53509: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 09:56:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3qIAwiNHfuKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 09:57:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<XxgsyCNHbN1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 09:58:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<l5O+ySNHzN4yBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-30 10:00:24 dovecot_plain authenticator failed for H=c-98-192-74-183.hsd1.ga.comcast.net (nackeabacs) [98.192.74.183]:35358: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 10:00:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EJgd0iNHGu4jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-12-30 10:01:03 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:56034: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-30 10:01:28 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:55200: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-30 10:01:58 dovecot_plain authenticator failed for H=(exual) [96.85.104.2]:39860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-30 10:07:20 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:41612: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-30 10:07:34 dovecot_login authenticator failed for H=([128.185.80.65]) [182.95.52.122]:57910: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.78
country_id: 1733045
description:
2025-12-30 10:07:43 dovecot_login authenticator failed for H=([49.125.201.78]) [49.125.201.78]:37802: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-30 10:07:51 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4015: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.251.104
country_id: 99237
description:
Dec 30 10:12:36 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=65.20.251.104, lip=66.85.158.91, TLS, session=<HEEV/CNHrJZBFPto>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 10:12:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<MzIC/iNHZKqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.173
country_id: 953987
description:
Dec 30 10:12:56 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=102.129.54.173, lip=66.85.158.91, TLS, session=<JCw7/SNH5+ZmgTat>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.253
country_id: 6252001
description:
Dec 30 10:14:09 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.253, lip=66.85.158.91, session=<KgevAiRHMeNb5qj9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.120
country_id: 6252001
description:
Dec 30 10:14:20 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.120, lip=66.85.158.91, session=<QhlRAyRHXYlb5qh4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.248
country_id: 6252001
description:
Dec 30 10:14:33 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.248, lip=66.85.158.91, session=<S+obBCRH8cBb5qj4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.253
country_id: 6252001
description:
Dec 30 10:14:36 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.253, lip=66.85.158.91, session=<gdBKBCRHG+Rb5qj9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 10:14:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<bNL8BCRHYpCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 10:15:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<6FqABiRH/qhV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 10:15:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<So0tByRHEFojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 10:18:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ulhNECRHxOQvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 10:25:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<UuazKSRHSJov/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 10:26:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<AKAHLSRHdIai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 10:26:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<dO15LSRHQt2eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 10:25:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<u6OVLCRHgJczTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-30 10:26:39 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:36388: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-30 10:26:47 dovecot_login authenticator failed for H=(AOzvnldl0) [158.94.208.110]:58822: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2025-12-30 10:26:56 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:46478: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-30 10:27:06 dovecot_login authenticator failed for H=(nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:48822: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.209.171
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.209.171] [Remote Port]=[56642] [Authentication Database]=[mail] [Username]=[hr@bostonlanka.com] (10/10 failures) (blocked until [Wed Dec 31 04:56:07 2025 UTC/Wed Dec 31 10:26:07 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-30 10:27:16 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:44684: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-30 10:27:35 dovecot_login authenticator failed for H=(pYk5f78WXT) [158.94.208.110]:64683: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2025-12-30 10:27:44 dovecot_login authenticator failed for H=([94.207.30.137]) [94.207.30.137]:36996: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-30 10:28:45 dovecot_login authenticator failed for H=(hp4UeP) [158.94.208.110]:56685: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Dec 30 10:29:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<2yOzNyRHxtHE+2YL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 10:30:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JoehPCRHAskzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 10:32:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=</QoERSRH9I2eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-30 10:33:58 dovecot_login authenticator failed for H=([115.244.235.242]) [43.241.132.152]:46188: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 10:34:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<EvQbSiRHBskFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 10:34:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<3mGMSyRHTfl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2025-12-30 10:34:38 dovecot_login authenticator failed for H=([182.95.87.148]) [182.95.184.82]:48118: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.77
country_id: 2186224
description:
2025-12-30 10:34:20 dovecot_login authenticator failed for H=([121.73.162.77]) [121.73.162.77]:41866: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 10:36:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<29HUUSRHoO1o7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 10:37:55 host2 pure-ftpd[1562543]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 10:38:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1RUlWSRHuKCYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 10:39:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<buHvXCRHsIhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 10:39:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wxwzXSRHNr0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 10:39:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<eoRhXSRHOIWnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-30 10:40:44 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (poricora) [24.127.53.61]:35868: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 10:41:07 host2 sshd[1565399]: Disconnected from invalid user blair 62.60.131.157 port 24807 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 10:42:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<MHD5ZyRHgqlnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 30 10:43:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<w/72ayRH1NXN0h+o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 10:46:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<8ceudCRH7xFniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2025-12-30 10:46:49 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:58076: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 10:46:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<gM++dyRHyM0v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2025-12-30 10:47:24 dovecot_login authenticator failed for H=([130.185.102.59]) [130.185.102.59]:37972: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 10:49:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<TuQ9giRHVLyi8GQy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.185.162.12
country_id: 1643084
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 93.185.162.12 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.108
country_id: 6252001
description:
Dec 30 10:53:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.108, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gl0ujiRHBsai2JVs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.108
country_id: 6252001
description:
Dec 30 10:54:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.108, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<QZ16kSRHzOCi2JVs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 10:57:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LzlMniRHfKUjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-30 10:57:53 dovecot_login authenticator failed for H=(105-170-97-62.cust.smartcall.no) [62.97.170.105]:43721: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-30 10:58:37 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:41658: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.108
country_id: 6252001
description:
Dec 30 10:58:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.108, lip=66.85.158.91, TLS, session=<XuUaoiRHXuai2JVs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 10:59:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<3R1JpiRHTpZCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-30 11:00:12 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [136.56.34.147]:55426: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-30 11:00:33 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:44228: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2025-12-30 11:00:45 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:55736: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.43.27
country_id: 3144096
description:
2025-12-30 11:00:30 dovecot_login authenticator failed for H=([178.232.43.27]) [178.232.43.27]:52623: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-12-30 11:01:45 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:43314: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-30 11:02:15 dovecot_login authenticator failed for H=(nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:44236: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2025-12-30 11:04:35 dovecot_login authenticator failed for H=pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:54715: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-30 11:04:38 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (flounwoofs) [98.203.34.136]:60168: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-30 11:05:06 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:36300: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 11:05:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5WhhuiRHHJYyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 11:08:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<tdE4wyRHPq6nrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.28.49.123
country_id: 6252001
description:
Dec 30 11:11:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.28.49.123, lip=66.85.158.91, TLS: Connection closed, session=<1QYC0CRHMpOVHDF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Dec 30 11:14:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<aJwO2iRH7K7E+2YS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.41.205
country_id: 1819730
description:
Dec 30 11:15:53 host2 dovecot[512723]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.41.205, lip=66.85.158.92, session=<pFt13yRH1KilminN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.41.205
country_id: 1819730
description:
Dec 30 11:15:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.41.205, lip=66.85.158.92, session=<pfVi3yRHyKelminN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 11:16:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<eCMT4CRHFtxV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2025-12-30 11:16:26 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:42414: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-30 11:16:41 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:44753: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-30 11:21:17 dovecot_plain authenticator failed for H=(fidly) [12.150.243.22]:49453: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 11:22:17 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (arthy) [87.103.126.54]:42040: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-30 11:22:22 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (loglors) [217.215.74.195]:38318: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 11:22:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<67My9yRHcFWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 11:26:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<skncBSVH3NYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 11:27:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<inRGCiVHAv9100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 11:28:59 host2 sshd[1608545]: Disconnected from invalid user kori 62.60.131.157 port 8078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.38
country_id: 1814991
description:
Dec 30 11:29:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.38, lip=66.85.158.91, session=<4HHJDiVHocNe584m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 1814991
description:
Dec 30 11:29:33 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.37, lip=66.85.158.91, session=<nfZTECVHnaFe584l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.35
country_id: 1814991
description:
Dec 30 11:29:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.35, lip=66.85.158.91, session=<pqGKECVH/cVe584j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.109
country_id: 1814991
description:
Dec 30 11:29:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=94.231.206.109, lip=66.85.158.91, session=<PqFoDyVHC7Ze585t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 11:30:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<+4llFCVH3sSeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 11:30:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<taaiFCVHcqcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 11:31:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<u3s/FyVHYq0zTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-30 11:31:42 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:49518: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-30 11:32:25 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:56454: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-12-30 11:34:05 dovecot_login authenticator failed for H=([182.95.193.177]) [182.95.223.114]:39290: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 11:33:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<udXJHSVH+qmeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 11:33:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qixcHiVH5OVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.244
country_id: 3144096
description:
2025-12-30 11:33:49 dovecot_login authenticator failed for H=(cm-84.211.12.244.get.no) [84.211.12.244]:44099: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 11:35:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ddHGJCVHnJ0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 11:36:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<bNR1JyVHOIYzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-30 11:36:36 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:46435: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 11:36:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dlTcKSVH1NRnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-30 11:36:57 dovecot_login authenticator failed for H=([207.219.221.53]) [207.219.221.53]:59852: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 11:38:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<IyVtLiVHqppo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 11:38:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<us+dMCVHmztniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 11:40:39 host2 pure-ftpd[1617374]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 11:42:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<x9GkPCVHMN0FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 11:44:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<9rkgRCVHqN2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 11:46:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<X57uTSVHxrOeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-30 11:46:19 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (deatisi) [67.172.54.29]:36174: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.248
country_id: 1269750
description:
Dec 30 11:48:57 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.18.166.248, lip=66.85.158.91, TLS, session=<4+l7VCVHoKlnEqb4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.181
country_id: 798544
description:
Dec 30 11:49:25 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=178.216.30.181, lip=66.85.158.91, TLS, session=<U8ZhViVHcd6y2B61>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 30 11:51:36 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<w+oqXyVHipqLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 11:52:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zKg8YiVHyswv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 30 11:53:59 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<l8WwZyVHbtFChJmL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 11:56:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<aw7NbiVHIDAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 11:57:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=</LiHdCVHWsmYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-30 11:57:43 dovecot_plain authenticator failed for H=(labilly) [91.73.195.150]:33096: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.249.95
country_id: 798544
description:
Dec 30 12:02:10 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=109.125.249.95, lip=66.85.158.91, TLS, session=<+YP9gyVHgdZtfflf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 12:02:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<jX4uhSVHfoRCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.245
country_id: 3865483
description:
Dec 30 12:02:30 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.177.200.245, lip=66.85.158.91, TLS, session=<MtQVhSVHsu0tscj1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Dec 30 12:05:09 host2 sshd[1636820]: Disconnected from invalid user vpnuser 54.38.190.246 port 44184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.59.179.138
country_id: 3608932
description:
Dec 30 12:04:59 host2 sshd[1636477]: Disconnected from invalid user ubuntu 138.59.179.138 port 50120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.144.62
country_id: 6252001
description:
Dec 30 12:05:39 host2 sshd[1637247]: Disconnected from invalid user blog 74.48.144.62 port 56008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.190.246
country_id: 3017382
description:
Dec 30 12:05:41 host2 sshd[1637258]: Disconnected from invalid user dario 54.38.190.246 port 38260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.59.179.138
country_id: 3608932
description:
Dec 30 12:07:30 host2 sshd[1638668]: Disconnected from invalid user sysadmin 138.59.179.138 port 52664 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.96
country_id: 6252001
description:
Dec 30 12:07:35 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.96, lip=66.85.158.91, session=<Z89bmCVH8u7G6xhg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.59.179.138
country_id: 3608932
description:
Dec 30 12:08:04 host2 sshd[1639248]: Disconnected from invalid user andre 138.59.179.138 port 40382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Dec 30 12:07:13 host2 sshd[1638339]: Disconnected from invalid user ubuntu 54.38.190.246 port 38220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 12:07:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<wTeIlyVHPNmnrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.48.144.62
country_id: 6252001
description:
Dec 30 12:09:11 host2 sshd[1640259]: Disconnected from invalid user ubuntu 74.48.144.62 port 45550 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 12:09:47 host2 sshd[1640858]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 12:10:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<xR0PoyVHbMWeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-30 12:10:50 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:37642: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-30 12:11:01 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:48885: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 12:11:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UojkpCVHAG4jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.211.185
country_id: 6252001
description:
Dec 30 12:10:33 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=147.182.211.185, lip=66.85.158.91, session=<KWb6oiVH+seTttO5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.158.35
country_id: 6252001
description:
Dec 30 12:10:33 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.105.158.35, lip=66.85.158.91, session=<6y3woiVH+KusaZ4j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.105.188.38
country_id: 1694008
description:
Dec 30 12:11:36 host2 sshd[1642615]: Disconnected from invalid user hyperspace 124.105.188.38 port 60408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.105.188.38
country_id: 1694008
description:
Dec 30 12:12:32 host2 sshd[1643513]: Disconnected from invalid user test 124.105.188.38 port 36477 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-30 12:13:35 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:44040: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-30 12:13:45 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:59708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 12:13:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<MLF/rCVHzpEyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.105.188.38
country_id: 1694008
description:
Dec 30 12:15:31 host2 sshd[1646122]: Disconnected from invalid user administrator 124.105.188.38 port 51480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 12:17:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<Fsk0uiVHjLRV6odu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.64
country_id: 6252001
description:
Dec 30 12:18:22 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.64, lip=66.85.158.92, TLS, session=<3KDnviVHovTN0h9A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 12:19:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<3e/YwSVHfCyi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 12:20:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<cMpSxyVHCS9100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.254.237
country_id: 2658434
description:
Dec 30 12:21:56 host2 pure-ftpd[1651427]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.254.237
country_id: 2658434
description:
Dec 30 12:22:00 host2 pure-ftpd[1651480]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.253.44
country_id: 6252001
description:
Dec 30 12:23:28 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.255.253.44, lip=66.85.158.91, session=<S+Iq0SVHYpSt//0s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.226.233
country_id: 6252001
description:
Dec 30 12:26:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.206.226.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dZ9M3CVHnKOszuLp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 12:27:55 host2 sshd[1655864]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 12:27:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<M4pD4CVHWONn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.188.177.46
country_id: 1643084
description:
Dec 30 12:28:16 host2 sshd[1656110]: Disconnected from invalid user stone 103.188.177.46 port 37646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 12:28:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rl1R4yVH9JueRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2025-12-30 12:29:37 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:50804: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.71.94
country_id: 3175395
description:
Dec 30 12:29:42 host2 sshd[1657133]: Disconnected from invalid user inssserver 151.43.71.94 port 30321 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.182.166.19
country_id: 3865483
description:
2025-12-30 12:29:49 dovecot_login authenticator failed for H=([190.182.166.19]) [190.182.166.19]:35956: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 30 12:29:50 host2 sshd[1657224]: Disconnected from invalid user viewtinet 20.193.141.133 port 1888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.126.156.58
country_id: 1269750
description:
Dec 30 12:30:43 host2 sshd[1658131]: Disconnected from invalid user openproject 13.126.156.58 port 45664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 30 12:30:50 host2 sshd[1658200]: Disconnected from invalid user user1 20.193.141.133 port 54945 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 12:31:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<9dFH7CVHBOwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 12:30:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<gvO16iVHHLhnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.81.111
country_id: 6252001
description:
Dec 30 12:31:16 host2 pure-ftpd[1658537]: (?@20.169.81.111) [INFO] New connection from 20.169.81.111


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 30 12:31:26 host2 sshd[1658654]: Disconnected from invalid user steam 20.193.141.133 port 32739 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 30 12:31:51 host2 sshd[1658914]: Disconnected from invalid user ai 103.100.208.88 port 50126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-30 12:32:49 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:49989: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-30 12:33:01 dovecot_login authenticator failed for H=([182.78.122.253]) [125.19.253.154]:54562: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 30 12:32:35 host2 sshd[1659442]: Disconnected from invalid user user2 103.100.208.88 port 57045 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.104.176.233
country_id: 1880251
description:
Dec 30 12:33:56 host2 sshd[1660589]: Disconnected from invalid user umar 172.104.176.233 port 60062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Dec 30 12:34:13 host2 sshd[1660768]: Disconnected from invalid user kyle 103.63.25.203 port 60332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.126.156.58
country_id: 1269750
description:
Dec 30 12:33:47 host2 sshd[1660450]: Disconnected from invalid user admin 13.126.156.58 port 54680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Dec 30 12:33:48 host2 sshd[1660483]: Disconnected from invalid user amber 186.96.151.198 port 36132 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 12:34:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zlpS+SVHXB1niu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.61.39.36
country_id: 2921044
description:
Dec 30 12:34:58 host2 sshd[1661411]: Disconnected from invalid user admin 5.61.39.36 port 58850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 12:35:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<z0XF+iVH+sgvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Dec 30 12:34:18 host2 sshd[1660846]: Disconnected from invalid user sandeep 186.96.151.198 port 57880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.126.156.58
country_id: 1269750
description:
Dec 30 12:34:22 host2 sshd[1660872]: Disconnected from invalid user ark 13.126.156.58 port 48158 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 30 12:35:26 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pBz3+yVHxF1ChJmN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Dec 30 12:36:08 host2 sshd[1662575]: Disconnected from invalid user ubuntu 101.36.98.91 port 57774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 12:36:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GQwq/iVHaLUv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.104.176.233
country_id: 1880251
description:
Dec 30 12:35:16 host2 sshd[1661818]: Disconnected from invalid user ftpuser 172.104.176.233 port 59476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec 30 12:35:36 host2 sshd[1662135]: Disconnected from invalid user proxyuser 83.235.21.125 port 51950 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.63.25.203
country_id: 1643084
description:
Dec 30 12:35:40 host2 sshd[1662123]: Disconnected from invalid user rabbitmq 103.63.25.203 port 59434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 12:36:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<gMyX/iVHxsinrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.63.223.138
country_id: 3469034
description:
Dec 30 12:37:05 host2 sshd[1663323]: Disconnected from invalid user testuser 201.63.223.138 port 52118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.104.176.233
country_id: 1880251
description:
Dec 30 12:37:08 host2 sshd[1663360]: Disconnected from invalid user ubuntu 172.104.176.233 port 41708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-12-30 12:37:48 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:60544: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.219
country_id: 6252001
description:
Dec 30 12:37:32 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.219, lip=66.85.158.92, TLS, session=<M1duAyZHiO3G6xjb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2025-12-30 12:37:38 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:39276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 12:37:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ekCjAiZHuOQzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 12:38:15 host2 sshd[1664236]: Disconnected from invalid user admin 2.57.121.112 port 49280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.79.252
country_id: 1643084
description:
Dec 30 12:38:49 host2 sshd[1664662]: Disconnected from invalid user tao 27.112.79.252 port 46758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 12:38:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rJjABiZHtrKi8GQy>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 5.61.39.36
country_id: 2921044
description:
Dec 30 12:38:45 host2 sshd[1664680]: Received disconnect from 5.61.39.36 port 49618:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.230.135.52
country_id: 6252001
description:
Dec 30 12:39:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.230.135.52, lip=66.85.158.92, session=<TIjPCyZHrput5oc0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.70
country_id: 6252001
description:
Dec 30 12:40:02 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<fMRlDCZHkrgUQGhG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-30 12:39:40 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (grakiling) [67.173.58.47]:42432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 12:39:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<TOlCCyZHogpo7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.205.134.167
country_id: 6252001
description:
Dec 30 12:39:53 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=67.205.134.167, lip=66.85.158.92, session=<2yXZCyZH+OdDzYan>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-30 12:40:13 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:37291: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Dec 30 12:39:33 host2 sshd[1665297]: Disconnected from invalid user admin 101.36.98.91 port 49136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.104.176.233
country_id: 1880251
description:
Dec 30 12:39:35 host2 sshd[1665306]: Disconnected from invalid user admin 172.104.176.233 port 60606 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 149.113.248.183
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 149.113.248.183: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.55
country_id: 1819730
description:
2025-12-30 12:40:41 dovecot_login authenticator failed for H=(182.239.78.55.hk.chinamobile.com) [182.239.78.55]:27770: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-30 12:40:56 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [116.72.9.151]:60238: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.252
country_id: 1643084
description:
Dec 30 12:41:25 host2 sshd[1667699]: Disconnected from invalid user radio 27.112.79.252 port 35388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.71.94
country_id: 3175395
description:
Dec 30 12:41:37 host2 sshd[1667947]: Disconnected from invalid user jenkins 151.43.71.94 port 30764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 12:41:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<lkciEyZHOLIzTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 12:43:25 host2 pure-ftpd[1669243]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.71.94
country_id: 3175395
description:
Dec 30 12:43:35 host2 sshd[1669317]: Disconnected from invalid user publicftp 151.43.71.94 port 30526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.71.94
country_id: 3175395
description:
Dec 30 12:44:33 host2 sshd[1669989]: Disconnected from invalid user user2 151.43.71.94 port 30242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 12:50:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<lmAmMCZH/pcFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.98.166.120
country_id: 6252001
description:
Dec 30 12:51:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.98.166.120, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jqqlNiZH8OYUYqZ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.115.158
country_id: 6252001
description:
Dec 30 12:51:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.33.115.158, lip=66.85.158.92, session=<3Em7NiZH/K8tIXOe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 12:54:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=</jBnPiZHuoWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 12:53:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bNG0PCZHoIwjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.33.185
country_id: 690791
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 95.164.33.185 - v-deploy@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.163.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 191.102.163.237 - careers@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 12:58:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<O20UTSZHsrYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2025-12-30 13:03:07 dovecot_plain authenticator failed for H=c-73-21-28-14.hsd1.ga.comcast.net (foring) [73.21.28.14]:49404: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 13:04:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<c+UIZCZHSr9CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 13:05:56 host2 sshd[1688310]: Disconnected from invalid user admin 2.57.121.112 port 27860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 13:07:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<opfFbyZH7NqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 13:08:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<GzFLcSZHhLOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 13:08:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jCiJciZHkKojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.201.65
country_id: 2921044
description:
Dec 30 13:10:48 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.201.65, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<wUFxeiZHF7guZclB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.107
country_id: 798544
description:
Dec 30 13:11:04 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=212.59.224.107, lip=66.85.158.91, TLS, session=<nhdQeiZHAdnUO+Br>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-30 13:10:15 dovecot_login authenticator failed for H=(128.102.88.80.sta.ac-net.se) [80.88.102.128]:48394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.47.81
country_id: 6251999
description:
2025-12-30 13:10:16 dovecot_login authenticator failed for H=dhcp-4-bc-9f-52-e4-f.cpe.i-zoom.net [24.137.47.81]:56779: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2025-12-30 13:10:39 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:34959: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-30 13:10:41 dovecot_plain authenticator failed for H=(inglic) [94.201.22.158]:41941: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.232
country_id: 3469034
description:
Dec 30 13:11:23 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=45.183.92.232, lip=66.85.158.91, TLS, session=<cIR2eyZHNestt1zo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.222.129
country_id: 2921044
description:
Dec 30 13:11:24 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=209.38.222.129, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OUaNfCZHlonRJt6B>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.49.93
country_id: 6252001
description:
Dec 30 13:14:04 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.29.49.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NVIbhiZHnNcUHTFd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 13:14:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<5l+9hyZH0WN100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 13:16:18 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61542: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 13:16:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<5Ma2jyZHTiqi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 13:18:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Jw8JliZHWKqYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 13:18:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<t7IplyZHBOZV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-30 13:19:59 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:55284: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-30 13:20:14 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:56590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 13:21:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<V9FCoSZHhKgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 13:22:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Km+7pSZHbJBn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:23:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<aYyXqSZHRrsDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 13:25:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<s6uTrSZH+rNnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:25:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BxYJsCZH3uwDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 13:26:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N6wWsiZHRuKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 13:26:43 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ZBk4syZHlEZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 13:27:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<19m1tiZHwMsv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.134
country_id: 6252001
description:
2025-12-30 13:29:50 dovecot_login authenticator failed for H=([209.23.73.134]) [209.23.73.134]:39448: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-30 13:30:07 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:32910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:29:23 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<zEjhvCZHaO0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:30:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+EDIwCZH/sADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:31:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ldidwyZHzLMDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 13:32:15 host2 sshd[1709512]: Disconnected from invalid user user 2.57.121.25 port 15648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-30 13:32:55 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (enerlinted) [196.47.172.253]:38364: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:33:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=772) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS: read(size=772) failed: Connection reset by peer, session=<hZsKzCZH+JQDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 13:33:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tyFeyyZHPtmi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.189
country_id: 1733045
description:
2025-12-30 13:33:37 dovecot_login authenticator failed for H=([49.124.148.189]) [49.124.148.189]:48098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-12-30 13:34:38 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:3801: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 13:37:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<fJZ62SZHPuanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2025-12-30 13:37:56 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:53766: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2025-12-30 13:38:09 dovecot_login authenticator failed for H=([182.95.58.18]) [182.95.58.18]:38034: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-12-30 13:40:50 dovecot_login authenticator failed for H=([209.23.72.144]) [209.23.72.144]:58192: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.24
country_id: 1733045
description:
2025-12-30 13:41:05 dovecot_login authenticator failed for H=([49.124.153.24]) [49.124.153.24]:46234: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 13:41:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<jZQu6CZHzo5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 13:42:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<qcMR6iZHgqUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 13:44:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<dwyz8SZHioAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 13:45:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<bp6h9SZHyr4vWBNS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 13:46:18 host2 pure-ftpd[1722415]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Dec 30 13:47:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<L8Qk/CZH2tjE+2YN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 13:48:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<7XpLAidH6s0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 13:51:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<v3FBCydHsKwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.102.16.220
country_id: 3469034
description:
Dec 30 13:56:56 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.102.16.220, lip=66.85.158.91, TLS, session=</KJMHidHtK27ZhDc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 13:57:57 host2 sshd[1732397]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.199
country_id: 3175395
description:
Dec 30 13:57:14 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.199, lip=66.85.158.91, TLS, session=<wzl6HydHHra5xQnH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 13:58:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<h9ygIydH8NQFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 13:58:21 host2 sshd[1732694]: Disconnected from invalid user yasmeen 62.60.131.157 port 9611 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.228.204
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 212.104.228.204 - chinthana.rajapaksha@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.107
country_id: 2921044
description:
Dec 30 14:02:03 host2 sshd[1735642]: Disconnected from invalid user ftpuser 193.23.199.107 port 56926 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.85
country_id: 6252001
description:
Dec 30 14:01:31 host2 pure-ftpd[1735230]: (?@205.210.31.85) [INFO] New connection from 205.210.31.85


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 14:04:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<oAK2OCdHPokv/AU1>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 193.23.199.107
country_id: 2921044
description:
Dec 30 14:04:43 host2 sshd[1737849]: Received disconnect from 193.23.199.107 port 49048:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-30 14:05:26 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (forrate) [24.91.103.202]:37492: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.23.199.107
country_id: 2921044
description:
Dec 30 14:06:34 host2 sshd[1739307]: Disconnected from invalid user ftpuser2 193.23.199.107 port 48602 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 14:06:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<qFuEQidHVM2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 14:07:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ka/bQydH/JCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 14:06:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JEjRQCdHrqAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 14:06:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<L7HyQCdHStNCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.107
country_id: 2921044
description:
Dec 30 14:07:53 host2 sshd[1740373]: Disconnected from invalid user user10 193.23.199.107 port 34872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 14:08:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<j5enSCdHMkt100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-30 14:08:53 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:49198: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-12-30 14:09:10 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:39653: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-12-30 14:13:51 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:42748: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 14:14:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<syKWXSdHKpKi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-30 14:14:26 dovecot_login authenticator failed for H=(223-197-153-143.static.imsbiz.com) [223.197.153.143]:64599: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Dec 30 14:15:12 host2 sshd[1747099]: Disconnected from invalid user admin 5.29.135.63 port 39006 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 14:16:04 host2 sshd[1747948]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 14:16:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<OfKlZidHooieRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-30 14:17:47 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (tratins) [98.40.101.10]:50040: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 14:17:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gv6AaidH/Chniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.29.135.63
country_id: 294640
description:
Dec 30 14:17:58 host2 sshd[1749525]: Disconnected from invalid user ubuntu 5.29.135.63 port 38390 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.228.204
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 212.104.228.204 - chiranthana.rajapaksha@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 14:18:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<0yOiaydHuudn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.7
country_id: 798549
description:
Dec 30 14:18:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.7, lip=66.85.158.92, session=<9zvPaydH5JZV2YwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.10
country_id: 798549
description:
Dec 30 14:19:45 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.10, lip=66.85.158.92, TLS: Connection closed, session=<vekFcSdHjKFV2ZUK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 14:19:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4uFycSdHJpFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 14:19:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<km9/cSdHkKhV6odu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Dec 30 14:19:29 host2 sshd[1750611]: Disconnected from invalid user git1 5.29.135.63 port 50628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.208
country_id: 1733045
description:
2025-12-30 14:20:52 dovecot_login authenticator failed for H=([49.124.152.208]) [49.124.152.208]:41610: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 14:24:43 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+cehgidHqKsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 14:25:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<yLgdhCdH3NmeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 14:25:28 host2 sshd[1755098]: Disconnected from invalid user yasmeen 62.60.131.157 port 62292 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 14:26:16 host2 sshd[1755479]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec 30 14:27:06 host2 sshd[1756161]: Disconnected from invalid user service 36.67.70.198 port 48804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.106.63.80
country_id: 3469034
description:
Dec 30 14:28:00 host2 sshd[1756734]: Disconnected from invalid user wordpress 177.106.63.80 port 50028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 14:28:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<XCXdjidHptOi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.106.63.80
country_id: 3469034
description:
Dec 30 14:27:15 host2 sshd[1756267]: Disconnected from invalid user photos 177.106.63.80 port 36112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 30 14:27:49 host2 sshd[1756618]: Disconnected from invalid user aleks 38.19.156.18 port 50786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.106.63.80
country_id: 3469034
description:
Dec 30 14:28:45 host2 sshd[1757349]: Disconnected from invalid user mac 177.106.63.80 port 35710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 30 14:29:47 host2 sshd[1758022]: Disconnected from invalid user hadoopuser 38.19.156.18 port 36338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.106.63.80
country_id: 3469034
description:
Dec 30 14:29:25 host2 sshd[1757818]: Disconnected from invalid user samp 177.106.63.80 port 49624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.112
country_id: 3017382
description:
Dec 30 14:31:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.112, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6mWKmSdHod9bxJhw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 14:31:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<vUyLmSdH+IKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 14:30:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<niY8lydHppAyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.26
country_id: 3017382
description:
Dec 30 14:31:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.26, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<FasAmydHQdBbxJga>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.116
country_id: 3017382
description:
Dec 30 14:31:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.116, lip=66.85.158.92, TLS: Connection closed, session=<n/QwmydHl+NbxJh0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-30 14:31:44 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:36094: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.27
country_id: 3017382
description:
Dec 30 14:31:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.27, lip=66.85.158.92, TLS: Connection closed, session=<QfktmidHCZtbxJgb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2025-12-30 14:31:26 dovecot_login authenticator failed for H=([84.211.13.203]) [84.211.13.203]:36264: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.67.70.198
country_id: 1643084
description:
Dec 30 14:32:25 host2 sshd[1759977]: Disconnected from invalid user sistemas 36.67.70.198 port 36020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 30 14:32:47 host2 sshd[1760166]: Disconnected from invalid user lynx 89.116.31.97 port 59934 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.48
country_id: 3017382
description:
Dec 30 14:34:29 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.48, lip=66.85.158.92, TLS: Connection closed, session=<Bf61pSdH2Ydb51kw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.192
country_id: 3017382
description:
Dec 30 14:34:41 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.192, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<hF5lpidHGcBb51nA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.50
country_id: 3017382
description:
Dec 30 14:34:44 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.50, lip=66.85.158.92, TLS: Connection closed, session=<epaVpidHzZ9b51ky>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.55
country_id: 3017382
description:
Dec 30 14:34:18 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.55, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pHcRpSdHXdRb51k3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.223.75.89
country_id: 3469034
description:
Dec 30 14:35:39 host2 sshd[1763217]: Disconnected from invalid user hans 191.223.75.89 port 45372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.223.75.89
country_id: 3469034
description:
Dec 30 14:36:42 host2 sshd[1763956]: Disconnected from invalid user paulo 191.223.75.89 port 29996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 14:36:16 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unsupous) [87.103.126.54]:16634: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.223.75.89
country_id: 3469034
description:
Dec 30 14:37:22 host2 sshd[1764444]: Disconnected from invalid user admin 191.223.75.89 port 43396 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 30 14:39:07 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<ksZKtidHrumLonQW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.123.7.15
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 23.123.7.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.23.183.33
country_id: 2921044
description:
Dec 30 14:39:35 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=82.23.183.33, lip=66.85.158.92, session=<iDjttydHnMRSF7ch>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 14:40:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<KjVcuSdHrrqYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.253.205
country_id: 1819730
description:
Dec 30 14:42:07 host2 sshd[1769379]: Disconnected from invalid user ftpuser 152.32.253.205 port 51200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 30 14:42:55 host2 sshd[1770068]: Disconnected from invalid user harry 64.23.180.137 port 41024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 30 14:43:06 host2 sshd[1770230]: Disconnected from invalid user radio 146.190.93.207 port 40186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 14:43:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<d5qTxCdHEOFo7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 30 14:43:26 host2 sshd[1770526]: Disconnected from invalid user ubuntu 64.23.180.137 port 50886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 30 14:43:49 host2 sshd[1770820]: Disconnected from invalid user temp 146.190.93.207 port 53716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.238
country_id: 1269750
description:
Dec 30 14:45:09 host2 sshd[1772218]: Disconnected from invalid user ashish 117.252.16.238 port 54984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 30 14:45:54 host2 sshd[1772963]: Disconnected from invalid user tao 146.190.93.207 port 60476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.238
country_id: 1269750
description:
Dec 30 14:46:32 host2 sshd[1773841]: Disconnected from invalid user share 117.252.16.238 port 55376 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.180.118
country_id: 3932488
description:
Dec 30 14:47:45 host2 sshd[1774934]: Disconnected from invalid user cvs 161.132.180.118 port 7121 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 30 14:49:14 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<yPR32idHfMlChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 14:48:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<MTv71idHoLYv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.180.118
country_id: 3932488
description:
Dec 30 14:48:22 host2 sshd[1775525]: Disconnected from invalid user fmaster 161.132.180.118 port 7122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.238
country_id: 1269750
description:
Dec 30 14:48:35 host2 sshd[1775693]: Disconnected from invalid user test 117.252.16.238 port 48488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 14:48:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VQxD2CdHsI8jupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 14:48:57 host2 pure-ftpd[1776069]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.253.205
country_id: 1819730
description:
Dec 30 14:49:06 host2 sshd[1776226]: Disconnected from invalid user temp 152.32.253.205 port 54002 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 30 14:49:17 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, session=<jcCg2idHoslChJmK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.60.75
country_id: 6252001
description:
Dec 30 14:50:53 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.99.60.75, lip=66.85.158.92, TLS, session=<vAxg4CdHvLunYzxL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.39.20.135
country_id: 6251999
description:
Dec 30 14:51:03 host2 sshd[1778308]: Disconnected from invalid user musikbot 54.39.20.135 port 52470 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 14:50:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<3vG13idHMt8zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.20.135
country_id: 6251999
description:
Dec 30 14:50:33 host2 sshd[1777750]: Disconnected from invalid user ftpadmin 54.39.20.135 port 32768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.20.135
country_id: 6251999
description:
Dec 30 14:51:33 host2 sshd[1778810]: Disconnected from invalid user infra 54.39.20.135 port 42118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 14:54:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Y76w7CdHILIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 14:54:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<b6Ot7idHXMwzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-30 14:55:48 dovecot_login authenticator failed for H=(cm-84.210.149.45.get.no) [84.210.149.45]:41835: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.151
country_id: 1733045
description:
2025-12-30 14:55:21 dovecot_login authenticator failed for H=([49.124.152.151]) [49.124.152.151]:43970: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.253.205
country_id: 1819730
description:
Dec 30 14:59:54 host2 sshd[1786821]: Disconnected from invalid user agotoz 152.32.253.205 port 50316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-30 15:00:36 dovecot_login authenticator failed for H=069.138.48.116.static.netvigator.com [116.48.138.69]:61360: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2025-12-30 15:00:48 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:55298: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 15:01:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XEGCByhHVoR100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 15:03:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EijLDShH9sojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 15:04:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3QGREihHUJgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 15:04:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<04I/EihHpo+eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 15:06:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ouscreness) [87.103.126.54]:35105: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 15:08:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<OlEzHihH+s5CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 15:07:22 host2 sshd[1793980]: Disconnected from invalid user admin 2.57.121.112 port 17739 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.127.202.128
country_id: 6252001
description:
Dec 30 15:07:23 host2 pure-ftpd[1794028]: (?@20.127.202.128) [INFO] New connection from 20.127.202.128


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 15:09:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<CqC4IShHDQVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 15:08:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<7k57HihHOOKnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 15:10:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pe4iJShH7LMv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-30 15:11:09 dovecot_login authenticator failed for H=([196.190.43.162]) [196.190.43.167]:51230: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-30 15:10:30 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:46448: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 15:11:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<HNOvKShHBiui8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 15:12:16 host2 sshd[1798290]: Disconnected from invalid user glen 62.60.131.157 port 59645 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 15:13:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qov1LyhHZJJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 15:15:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ctCwNihHKLVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 15:21:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<oKdrTChHHrZV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.85.86
country_id: 3175395
description:
2025-12-30 15:21:51 dovecot_login authenticator failed for H=([2.192.85.86]) [2.192.85.86]:41150: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 15:21:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<lgzrTihHno0v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-30 15:21:16 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:58304: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 15:21:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<R+8OTihHiOyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 15:22:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<YlHaUihHUO2eRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 30 15:23:50 host2 sshd[1807574]: Disconnected from invalid user panda 209.15.119.12 port 59064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.251.32
country_id: 2661886
description:
Dec 30 15:25:48 host2 sshd[1808980]: Disconnected from invalid user arma3server 62.60.251.32 port 42664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-30 15:26:01 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:46434: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 15:26:16 host2 sshd[1809276]: Disconnected from invalid user user 2.57.121.25 port 14666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-30 15:26:17 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:53896: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.23.183.33
country_id: 2921044
description:
Dec 30 15:26:47 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=82.23.183.33, lip=66.85.158.91, session=<dlC3YChHEq9SF7ch>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.216.74
country_id: 1643084
description:
Dec 30 15:26:57 host2 sshd[1809659]: Disconnected from invalid user activemq 103.101.216.74 port 50462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 30 15:27:04 host2 sshd[1809765]: Disconnected from invalid user mailer 209.15.119.12 port 34550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.216.74
country_id: 1643084
description:
Dec 30 15:28:10 host2 sshd[1810661]: Disconnected from invalid user jack 103.101.216.74 port 52306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.251.32
country_id: 2661886
description:
Dec 30 15:27:18 host2 sshd[1809911]: Disconnected from invalid user test3 62.60.251.32 port 49308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 30 15:27:40 host2 sshd[1810103]: Disconnected from invalid user csgo 209.15.119.12 port 40706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 30 15:28:15 host2 sshd[1810731]: Disconnected from invalid user couchdb 209.15.119.12 port 48296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.251.32
country_id: 2661886
description:
Dec 30 15:28:34 host2 sshd[1811015]: Disconnected from invalid user admin1 62.60.251.32 port 59248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.216.74
country_id: 1643084
description:
Dec 30 15:28:52 host2 sshd[1811268]: Disconnected from invalid user vps 103.101.216.74 port 34760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.101.216.74
country_id: 1643084
description:
Dec 30 15:30:13 host2 sshd[1812616]: Disconnected from invalid user vbox 103.101.216.74 port 46086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-30 15:33:07 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:48086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-30 15:33:24 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:55772: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 15:37:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<pCEqhShHNsCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 15:37:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<gVsEhyhH2qsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 15:39:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ZaynjChHDKeeRdGr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.31
country_id: 6252001
description:
Dec 30 15:40:39 host2 pure-ftpd[1820927]: (?@40.124.173.31) [INFO] New connection from 40.124.173.31


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 15:43:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<+YTwnChHtpdo7MS0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 15:45:51 host2 sshd[1824553]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 15:46:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OxAGpihHYKAjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-30 15:46:13 dovecot_login authenticator failed for H=([125.19.175.94]) [122.184.120.98]:33900: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-30 15:46:32 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:37923: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2025-12-30 15:48:06 dovecot_login authenticator failed for H=([182.78.64.18]) [182.78.64.18]:55642: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.14
country_id: 2186224
description:
2025-12-30 15:48:31 dovecot_login authenticator failed for H=([121.73.163.14]) [121.73.163.14]:34350: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-12-30 15:50:24 dovecot_login authenticator failed for H=([121.73.169.161]) [121.73.169.161]:52618: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2025-12-30 15:50:42 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:51606: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-30 15:50:55 dovecot_login authenticator failed for H=([27.123.113.86]) [27.123.113.86]:51068: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 15:51:42 host2 pure-ftpd[1829397]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.22.86
country_id: 1149361
description:
2025-12-30 15:51:17 dovecot_login authenticator failed for H=([149.54.22.86]) [149.54.22.86]:49768: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.200.42.78
country_id: 6252001
description:
[2025-12-30 15:53:07 +0530] info [cpaneld] 107.200.42.78 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.191.164.249
country_id: 6252001
description:
[2025-12-30 15:53:10 +0530] info [cpaneld] 76.191.164.249 - kamechotech "GET /login/?login_only=1&user=kamechotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.103.22.30
country_id: 6252001
description:
[2025-12-30 15:53:09 +0530] info [cpaneld] 99.103.22.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.167.79.90
country_id: 6252001
description:
[2025-12-30 15:53:11 +0530] info [whostmgrd] 71.167.79.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.86.128
country_id: 6252001
description:
[2025-12-30 15:53:13 +0530] info [cpaneld] 129.222.86.128 - kamechot "GET /login/?login_only=1&user=kamechot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.208.113.235
country_id: 6252001
description:
[2025-12-30 15:53:12 +0530] info [cpaneld] 108.208.113.235 - kamechotechcom "GET /login/?login_only=1&user=kamechotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotechcom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 15:52:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<se0FvShHiqqeRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.131.128.44
country_id: 6252001
description:
[2025-12-30 15:53:19 +0530] info [cpaneld] 135.131.128.44 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.33.131.161
country_id: 6252001
description:
[2025-12-30 15:53:14 +0530] info [cpaneld] 64.33.131.161 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.180.8.224
country_id: 6252001
description:
[2025-12-30 15:53:15 +0530] info [cpaneld] 216.180.8.224 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.145.101.50
country_id: 6252001
description:
[2025-12-30 15:53:16 +0530] info [cpaneld] 99.145.101.50 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.87.30
country_id: 6252001
description:
[2025-12-30 15:53:23 +0530] info [cpaneld] 96.2.87.30 - kamecho2 "GET /login/?login_only=1&user=kamecho2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 15:53:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<l8ZiwChHmJwv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.47.150
country_id: 6252001
description:
[2025-12-30 15:53:18 +0530] info [cpaneld] 129.222.47.150 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.206.160
country_id: 6252001
description:
[2025-12-30 15:53:21 +0530] info [cpaneld] 73.71.206.160 - kamecho1 "GET /login/?login_only=1&user=kamecho1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.223.198
country_id: 6252001
description:
[2025-12-30 15:53:20 +0530] info [cpaneld] 172.56.223.198 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 15:54:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<EkhRxChH6MozTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.197.163.38
country_id: 2750405
description:
Dec 30 15:55:04 host2 sshd[1832401]: Disconnected from invalid user sammy 185.197.163.38 port 57510 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.197.163.38
country_id: 2750405
description:
Dec 30 15:54:34 host2 sshd[1831763]: Received disconnect from 185.197.163.38 port 48310:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.197.163.38
country_id: 2750405
description:
Dec 30 15:54:34 host2 sshd[1831763]: Disconnected from invalid user ftp_user 185.197.163.38 port 48310 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 15:55:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<MbOVxihH575100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 15:58:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<iFxN0ChHEr6YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 15:59:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<iBxC1ChH9oczTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 16:00:25 host2 dovecot[1835840]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<fSHj2ChHQQ1niu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.68
country_id: 294640
description:
Dec 30 16:01:43 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.88.26.68, lip=66.85.158.91, TLS, session=<8a+x3ShHqICVWBpE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.124.147
country_id: 3042225
description:
Dec 30 16:01:44 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.124.147, lip=66.85.158.91, session=<dqi93ShHZtZbWnyT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.183
country_id: 290557
description:
Dec 30 16:01:45 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=217.138.193.183, lip=66.85.158.91, session=<eCLD3ShHTLzZisG3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.28
country_id: 2629691
description:
Dec 30 16:01:44 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.133.193.28, lip=66.85.158.91, session=<fqjA3ShHTpgthcEc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.162.149
country_id: 146669
description:
Dec 30 16:02:13 host2 pure-ftpd[1837974]: (?@185.253.162.149) [INFO] New connection from 185.253.162.149


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 16:01:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Vzgb3ChHEKAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 16:01:34 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<IwgG3ShHeqEvWBNS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.132.194.58
country_id: 597427
description:
Dec 30 16:01:40 host2 pure-ftpd[1837627]: (?@45.132.194.58) [INFO] New connection from 45.132.194.58


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.55
country_id: 1831722
description:
Dec 30 16:01:41 host2 pure-ftpd[1837637]: (?@188.215.235.55) [INFO] New connection from 188.215.235.55


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.141.249
country_id: 617790
description:
Dec 30 16:01:44 host2 dovecot[1836975]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=178.175.141.249, lip=66.85.158.91, session=<GKG83ShH8Jqyr435>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.101.94.117
country_id: 3175395
description:
Dec 30 16:01:43 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.101.94.117, lip=66.85.158.91, TLS, session=<gWWn3ShHqpZXZV51>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.32.122.10
country_id: 597427
description:
Dec 30 16:01:43 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=194.32.122.10, lip=66.85.158.91, TLS handshaking: Connection closed, session=</KKn3ShHeKjCIHoK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.186
country_id: 732800
description:
Dec 30 16:01:43 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=156.146.55.186, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ujex3ShHoICckje6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 16:02:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<8qgH4ShHMImeRdY+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 16:03:57 host2 sshd[1839282]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.237.124.111
country_id: 99237
description:
2025-12-30 16:04:13 dovecot_plain authenticator failed for H=([89.116.164.85]) [37.237.124.111]:49926: 535 Incorrect authentication data (set_id=info@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.237.124.111
country_id: 99237
description:
2025-12-30 16:04:20 dovecot_login authenticator failed for H=([89.116.164.85]) [37.237.124.111]:49926: 535 Incorrect authentication data (set_id=info@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.201.206.219
country_id: 6252001
description:
2025-12-30 16:04:25 dovecot_plain authenticator failed for H=108-201-206-219.lightspeed.cicril.sbcglobal.net ([89.116.164.85]) [108.201.206.219]:40807: 535 Incorrect authentication data (set_id=info@kamechotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 16:07:47 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<cfg38yhHbLpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 16:08:38 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<k9VL9ihHhrSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 16:09:34 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<NuGc+ShHBs9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 16:10:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<aKvv+yhHhqZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 16:10:14 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<kv76+yhHSt8FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 16:14:25 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<cS77CilHNqui8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.65
country_id: 798544
description:
2025-12-30 16:14:42 dovecot_login authenticator failed for H=(65.81.41.31.ip4.feromedia.eu) [31.41.81.65]:59594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-30 16:15:12 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:50976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 16:15:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<92RCDilHqtEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 16:19:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<iTqxGylHxtsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 16:20:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<FZrPISlHgNieRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.238.152.12
country_id: 99237
description:
2025-12-30 16:22:04 dovecot_plain authenticator failed for H=([89.116.164.85]) [37.238.152.12]:45702: 535 Incorrect authentication data (set_id=admin@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.199.227.197
country_id: 1282988
description:
2025-12-30 16:21:40 dovecot_plain authenticator failed for H=([89.116.164.85]) [113.199.227.197]:6645: 535 Incorrect authentication data (set_id=admin@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 16:22:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<0PwdJylHCq1V6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.215
country_id: 1733045
description:
2025-12-30 16:30:01 dovecot_login authenticator failed for H=([49.124.152.215]) [49.124.152.215]:54956: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Dec 30 16:30:14 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.197, lip=66.85.158.92, session=<6S+rQylHDupAPsXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-30 16:30:24 dovecot_login authenticator failed for H=([125.17.182.121]) [182.95.224.62]:54246: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Dec 30 16:30:26 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.197, lip=66.85.158.92, TLS: Connection closed, session=<p1dbRClHYMVAPsXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-30 16:33:20 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:51400: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 16:33:34 host2 sshd[1862052]: Disconnected from invalid user user 2.57.121.25 port 35646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.243.30
country_id: 1269750
description:
2025-12-30 16:33:51 dovecot_login authenticator failed for H=([125.16.185.97]) [152.52.243.30]:43202: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 16:36:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<2+SHWClH9MinrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.235.41
country_id: 1733045
description:
2025-12-30 16:39:01 dovecot_plain authenticator failed for H=([89.116.164.85]) [118.100.235.41]:29628: 535 Incorrect authentication data (set_id=support@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.159.138
country_id: 3469034
description:
2025-12-30 16:39:15 dovecot_plain authenticator failed for H=177-202-159-138.dsl.brasiltelecom.net.br ([89.116.164.85]) [177.202.159.138]:48329: 535 Incorrect authentication data (set_id=support@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.159.138
country_id: 3469034
description:
2025-12-30 16:39:22 dovecot_login authenticator failed for H=177-202-159-138.dsl.brasiltelecom.net.br ([89.116.164.85]) [177.202.159.138]:48329: 535 Incorrect authentication data (set_id=support@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.205.196.164
country_id: 290557
description:
2025-12-30 16:39:29 dovecot_plain authenticator failed for H=bba-176-205-196-164.alshamil.net.ae ([89.116.164.85]) [176.205.196.164]:57220: 535 Incorrect authentication data (set_id=support@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 16:44:05 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<LjMKdSlH5rVo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Dec 30 16:43:45 host2 sshd[1870235]: Disconnected from invalid user junin 64.227.188.192 port 53884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 16:44:18 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ZOnRdSlHRIkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 16:44:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<2L6udylHNuMyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.188.192
country_id: 1269750
description:
Dec 30 16:45:43 host2 sshd[1871785]: Disconnected from invalid user elasticsearch 64.227.188.192 port 35296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Dec 30 16:46:23 host2 sshd[1872297]: Disconnected from invalid user builder 64.227.188.192 port 53790 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 16:48:32 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60930: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 16:48:47 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<gTHehSlHVYN100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.80.159
country_id: 3996063
description:
2025-12-30 16:51:00 dovecot_login authenticator failed for H=(201.172.80.159-clientes-izzi.mx) [201.172.80.159]:43252: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 16:52:20 host2 sshd[1876936]: Disconnected from invalid user infant 62.60.131.157 port 17741 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 16:52:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<c3R9kilHnjhniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 16:54:33 host2 pure-ftpd[1878990]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.235.135.97
country_id: 6252001
description:
2025-12-30 16:56:44 dovecot_plain authenticator failed for H=([89.116.164.85]) [68.235.135.97]:36974: 535 Incorrect authentication data (set_id=sales@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.194.50.226
country_id: 290291
description:
2025-12-30 16:56:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [82.194.50.226]:60440: 535 Incorrect authentication data (set_id=sales@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.232.10.196
country_id: 192950
description:
2025-12-30 16:56:32 dovecot_plain authenticator failed for H=([89.116.164.85]) [197.232.10.196]:57585: 535 Incorrect authentication data (set_id=sales@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 16:58:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<58rXqSlHmt8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 16:59:23 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<xuTKqylHEK4zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 16:59:26 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<WZvvqylH3pwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 16:59:52 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<vtSErSlHjqKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 17:00:34 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<llwGsClHDuqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 17:03:05 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<AaT/uClHyotn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 17:03:52 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<hnzUuylHutMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 17:04:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<KoiHvSlHZOlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 17:04:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<pHYhvylHKKWnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 17:06:40 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<1knTxSlHbOii8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-30 17:06:43 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:33302: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.142.154.110
country_id: 1819730
description:
Dec 30 17:06:49 host2 pure-ftpd[1889906]: (?@45.142.154.110) [INFO] New connection from 45.142.154.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.72.196
country_id: 6252001
description:
2025-12-30 17:06:51 dovecot_login authenticator failed for H=syn-074-218-072-196.biz.spectrum.com [74.218.72.196]:36087: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.118
country_id: 1149361
description:
2025-12-30 17:07:11 dovecot_login authenticator failed for H=([149.54.62.118]) [149.54.62.118]:40864: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 17:06:31 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<R3JPxSlHwo+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2025-12-30 17:07:42 dovecot_login authenticator failed for H=(TNtPqcCC6) [157.254.223.39]:49787: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2025-12-30 17:08:18 dovecot_login authenticator failed for H=(rO6JLTuoZ) [157.254.223.39]:53718: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 157.254.223.39
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[157.254.223.39] [Authentication Database]=[mail] [Username]=[inquire@lezzarotech.com] (5/5 failures) (blocked until [Tue Dec 30 11:53:34 2025 UTC/Tue Dec 30 17:23:34 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 17:09:09 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<MCCszilHKJIvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2025-12-30 17:11:37 dovecot_login authenticator failed for H=(wksBwjn) [157.254.223.39]:49602: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 17:12:10 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<gKR+2SlHgJVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 17:14:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<7jRX4ylHAM6YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 17:15:43 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<0IIp5ilH4NQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 17:16:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<M8xV6ClHeLkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 17:18:40 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<BP+R8ClHou2eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-30 17:19:34 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:43181: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-12-30 17:19:56 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:50668: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-30 17:20:03 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:62700: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 17:20:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ytiL+ClH7J4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 17:23:08 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<7NKxACpHVJZV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.172.1.254
country_id: 3469034
description:
2025-12-30 17:30:32 dovecot_plain authenticator failed for H=([89.116.164.85]) [45.172.1.254]:8930: 535 Incorrect authentication data (set_id=contact@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.8.246.4
country_id: 6252001
description:
2025-12-30 17:30:44 dovecot_plain authenticator failed for H=ip68-8-246-4.sd.sd.cox.net ([89.116.164.85]) [68.8.246.4]:48052: 535 Incorrect authentication data (set_id=contact@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.204.6.146
country_id: 6252001
description:
2025-12-30 17:30:20 dovecot_plain authenticator failed for H=76-204-6-146.lightspeed.livnmi.sbcglobal.net ([89.116.164.85]) [76.204.6.146]:52600: 535 Incorrect authentication data (set_id=contact@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.72.59
country_id: 3996063
description:
2025-12-30 17:32:36 dovecot_login authenticator failed for H=(201.173.72.59-clientes-izzi.mx) [201.173.72.59]:50161: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2025-12-30 17:32:49 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:59371: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 17:34:01 host2 sshd[1914839]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 30 17:34:10 host2 pure-ftpd[1914982]: (?@66.132.153.115) [INFO] New connection from 66.132.153.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.60.176
country_id: 1880251
description:
[2025-12-30 17:36:55 +0530] info [cpaneld] 138.199.60.176 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-30 17:41:07 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:36490: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-30 17:40:50 dovecot_login authenticator failed for H=([182.95.185.170]) [182.95.185.170]:44548: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 17:42:07 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<zUmVRCpH2O0jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 17:42:46 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<wnvsRipHzMR100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.14.32.198
country_id: 298795
description:
Dec 30 17:43:01 host2 sshd[1922149]: Disconnected from invalid user kim 213.14.32.198 port 65117 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-30 17:42:30 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:47491: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-12-30 17:42:41 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:53678: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 30 17:43:14 host2 sshd[1922316]: Disconnected from invalid user ry 34.66.72.251 port 53180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 17:44:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Cr4gTCpHKxVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.14.32.198
country_id: 298795
description:
Dec 30 17:44:40 host2 sshd[1923456]: Disconnected from invalid user simon 213.14.32.198 port 35019 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 17:45:29 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<gbCkUCpHPvBo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 30 17:45:56 host2 sshd[1924638]: Disconnected from invalid user simon 185.131.53.100 port 57324 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.14.32.198
country_id: 298795
description:
Dec 30 17:45:23 host2 sshd[1924268]: Disconnected from invalid user xiaoli 213.14.32.198 port 37402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.248.179
country_id: 1733045
description:
2025-12-30 17:47:52 dovecot_plain authenticator failed for H=([89.116.164.85]) [180.75.248.179]:40798: 535 Incorrect authentication data (set_id=contato@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.43.218.145
country_id: 3895114
description:
2025-12-30 17:47:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [181.43.218.145]:55070: 535 Incorrect authentication data (set_id=contato@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.5.29.194
country_id: 1643084
description:
2025-12-30 17:48:10 dovecot_plain authenticator failed for H=([89.116.164.85]) [61.5.29.194]:60752: 535 Incorrect authentication data (set_id=contato@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.5.29.194
country_id: 1643084
description:
2025-12-30 17:48:17 dovecot_login authenticator failed for H=([89.116.164.85]) [61.5.29.194]:60752: 535 Incorrect authentication data (set_id=contato@kamechotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 30 17:49:40 host2 sshd[1927077]: Disconnected from invalid user stage 34.66.72.251 port 42354 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.55.229.216
country_id: 6252001
description:
Dec 30 17:49:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.55.229.216, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<q005YCpHBpUtN+XY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.99.9.163
country_id: 1880251
description:
Dec 30 17:49:52 host2 sshd[1927254]: Disconnected from invalid user tao 139.99.9.163 port 50862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.137.5
country_id: 294640
description:
2025-12-30 17:49:23 dovecot_login authenticator failed for H=([84.111.137.5]) [84.111.137.5]:46959: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.34.139
country_id: 3144096
description:
2025-12-30 17:49:35 dovecot_login authenticator failed for H=([178.232.34.139]) [178.232.34.139]:34808: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.14.32.198
country_id: 298795
description:
Dec 30 17:50:13 host2 sshd[1927509]: Disconnected from invalid user me 213.14.32.198 port 55709 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.123
country_id: 3469034
description:
Dec 30 17:52:00 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=177.44.71.123, lip=66.85.158.91, TLS, session=<wCDwZipHNb6xLEd7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Dec 30 17:51:44 host2 dovecot[1836975]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=194.164.107.4, lip=66.85.158.91, TLS, session=<iDAlZypHcsvCpGsE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 17:52:12 host2 sshd[1929655]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.42
country_id: 3469034
description:
Dec 30 17:52:20 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=177.8.251.42, lip=66.85.158.91, TLS, session=<z7AxaCpHy72xCPsq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 30 17:52:21 host2 sshd[1929748]: Disconnected from invalid user nikita 34.66.72.251 port 59696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 17:52:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ZIQcaipHEMwyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.99.9.163
country_id: 1880251
description:
Dec 30 17:53:31 host2 sshd[1930493]: Disconnected from invalid user asdf 139.99.9.163 port 58312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 30 17:54:36 host2 sshd[1931373]: Disconnected from invalid user bitrix 185.131.53.100 port 56650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 30 17:55:55 host2 sshd[1932700]: Disconnected from invalid user git 185.131.53.100 port 49192 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.250
country_id: 2635167
description:
Dec 30 17:56:29 host2 dovecot[1836975]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.250, lip=66.85.158.92, TLS, session=<1WwbeCpHLapX7LD6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.127
country_id: 2635167
description:
Dec 30 17:56:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.127, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JCIoeCpHzaq594l/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-12-30 17:57:03 dovecot_login authenticator failed for H=89-67-5-135.dynamic.play.pl [89.67.5.135]:44962: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.128
country_id: 2635167
description:
Dec 30 17:57:03 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.128, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ZYcjeipHN8dX7LCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-30 17:57:51 dovecot_login authenticator failed for H=(mail.tataidc.com) [61.12.86.90]:43040: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.166
country_id: 3469034
description:
Dec 30 17:58:04 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.89.136.166, lip=66.85.158.91, TLS, session=<GCh+fCpH8Ka+WYim>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.138
country_id: 2635167
description:
Dec 30 17:58:10 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.138, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<tDUafipHp56594mK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 17:57:10 host2 pure-ftpd[1933770]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 17:57:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<k97xeipH9t8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.121
country_id: 2635167
description:
Dec 30 17:57:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.121, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<yvIefCpHueBX7LB5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.106.155.11
country_id: 798544
description:
Dec 30 17:58:22 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.106.155.11, lip=66.85.158.91, TLS, session=<pVjYfSpHerDBapsL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 17:58:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<taTZfypHnOmeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.125
country_id: 2635167
description:
Dec 30 17:58:44 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.125, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XkMlgCpHvY1X7LB9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 17:58:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<3IJKgCpHNO1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 17:58:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<4wB1gCpHwLKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 17:59:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<HNBXgSpH/q5n9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.126
country_id: 2635167
description:
Dec 30 17:59:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<waoegipHJblX7LB+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.114
country_id: 2635167
description:
Dec 30 17:59:50 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.114, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<3xUchCpHObBX7LBy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.135
country_id: 2635167
description:
Dec 30 18:00:57 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.135, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<eDETiCpHCaC594mH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-30 18:01:08 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (cless) [73.196.144.25]:55668: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.141
country_id: 2635167
description:
Dec 30 18:00:24 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.141, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Z8wZhipHZZ5X7LCN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.123
country_id: 2635167
description:
Dec 30 18:01:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.123, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<ToEOiipHTd+594l7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 18:02:07 host2 sshd[1937414]: Disconnected from invalid user admin 2.57.121.112 port 57134 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 18:03:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<nZBRjypHktAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 18:03:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lSVHjypHKLov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 18:04:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<kN0plipHSAei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 18:05:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=</rLFlipHCsqnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.195.192.223
country_id: 1694008
description:
2025-12-30 18:05:11 dovecot_plain authenticator failed for H=([89.116.164.85]) [180.195.192.223]:2100: 535 Incorrect authentication data (set_id=contacto@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.150.128.137
country_id: 2510769
description:
2025-12-30 18:05:24 dovecot_plain authenticator failed for H=137.red-79-150-128.dynamicip.rima-tde.net ([89.116.164.85]) [79.150.128.137]:59552: 535 Incorrect authentication data (set_id=contacto@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.27.236.207
country_id: 2635167
description:
2025-12-30 18:05:36 dovecot_plain authenticator failed for H=([89.116.164.85]) [176.27.236.207]:1450: 535 Incorrect authentication data (set_id=contacto@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 18:07:18 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<USKknipHTLszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 18:13:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<IpdOtCpHXp4v+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.246.4
country_id: 2264397
description:
[2025-12-30 18:13:15 +0530] info [cpaneld] 104.28.246.4 - kamechot "GET /json-api/cpanel?api.version=1&cpanel_jsonapi_module=Fileman&cpanel_jsonapi_func=listfiles HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 18:14:11 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<+bZBtypH+r9CdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.220.75.172
country_id: 6252001
description:
[2025-12-30 18:15:48 +0530] info [whostmgrd] 107.220.75.172 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.173
country_id: 2542007
description:
2025-12-30 18:15:53 dovecot_login authenticator failed for H=([105.73.93.173]) [105.73.93.173]:42374: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-30 18:15:20 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:42186: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 18:16:53 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<JgftwCpHAsueRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.116.98.38
country_id: 6252001
description:
[2025-12-30 18:16:59 +0530] info [whostmgrd] 98.116.98.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-12-30 18:17:31 dovecot_login authenticator failed for H=([103.230.176.152]) [103.230.176.152]:40466: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-30 18:17:50 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:34706: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 18:17:58 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Y+7MxCpHDIUvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:21:07 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lsMx0CpHzLADiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.13.115.139
country_id: 3865483
description:
2025-12-30 18:20:15 dovecot_plain authenticator failed for H=([89.116.164.85]) [186.13.115.139]:38890: 535 Incorrect authentication data (set_id=financeiro@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.215.253
country_id: 1733045
description:
2025-12-30 18:20:33 dovecot_plain authenticator failed for H=([89.116.164.85]) [113.211.215.253]:10318: 535 Incorrect authentication data (set_id=financeiro@kamechotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 30 18:20:47 host2 sshd[1951280]: Disconnected from invalid user test 201.124.168.139 port 56526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.20.187.190
country_id: 1605651
description:
2025-12-30 18:20:54 dovecot_plain authenticator failed for H=([89.116.164.85]) [1.20.187.190]:54926: 535 Incorrect authentication data (set_id=financeiro@kamechotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:21:15 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vtCm0CpHlrYDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 18:21:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<uwje0ipHrtUFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 18:22:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ZTWX0ypH8tqeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:22:25 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0TTY1CpHQIgDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 18:24:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=</xsu2ypHXscv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:24:35 host2 dovecot[1836975]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<squU3CpH7oIDiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.40.214.222
country_id: 6252001
description:
[2025-12-30 18:25:59 +0530] info [whostmgrd] 100.40.214.222 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:26:00 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<svqi4SpHEIwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:26:25 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Y0Mt4ypHDscDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 30 18:27:04 host2 sshd[1957087]: Disconnected from invalid user odoo 201.124.168.139 port 45530 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 30 18:27:42 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<w9y85ypH9IMDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 30 18:27:42 host2 sshd[1957634]: Disconnected from invalid user ubuntu 201.124.168.139 port 57270 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.143.74.95
country_id: 6252001
description:
[2025-12-30 18:29:34 +0530] info [whostmgrd] 71.143.74.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 18:30:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<EUi+8ipHkqeYNcU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.209.240.15
country_id: 6252001
description:
[2025-12-30 18:31:02 +0530] info [whostmgrd] 72.209.240.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:33:11 host2 sshd[1963177]: Disconnected from invalid user rustserver 197.211.55.20 port 33858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 18:34:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<xAP1/ypHIqmnrKy4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.223.98.97
country_id: 6252001
description:
[2025-12-30 18:34:29 +0530] info [whostmgrd] 75.223.98.97 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.125.94.71
country_id: 1643084
description:
Dec 30 18:35:30 host2 sshd[1965532]: Disconnected from invalid user git 202.125.94.71 port 46532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 18:35:59 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<QwVABStHNr+eRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.198.211.201
country_id: 6252001
description:
[2025-12-30 18:36:11 +0530] info [whostmgrd] 72.198.211.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.122.68
country_id: 6252001
description:
[2025-12-30 18:36:10 +0530] info [whostmgrd] 71.30.122.68 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.202.14.129
country_id: 6252001
description:
[2025-12-30 18:36:22 +0530] info [whostmgrd] 73.202.14.129 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 18:36:35 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ww9gBytH+kFniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.125.94.71
country_id: 1643084
description:
Dec 30 18:36:51 host2 sshd[1966727]: Disconnected from invalid user daisy 202.125.94.71 port 41988 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.20.123.32
country_id: 6252001
description:
[2025-12-30 18:37:07 +0530] info [whostmgrd] 50.20.123.32 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.83.52.20
country_id: 6252001
description:
[2025-12-30 18:36:42 +0530] info [whostmgrd] 74.83.52.20 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 18:37:01 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fivsCCtHhvh100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 30 18:37:26 host2 sshd[1967167]: Disconnected from invalid user wireguard 158.69.194.34 port 34016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:37:28 host2 sshd[1967175]: Disconnected from invalid user rise 197.211.55.20 port 34700 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.79.55.4
country_id: 6252001
description:
[2025-12-30 18:37:37 +0530] info [whostmgrd] 64.79.55.4 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.20.0.160
country_id: 6252001
description:
2025-12-30 18:37:49 dovecot_plain authenticator failed for H=([89.116.164.85]) [67.20.0.160]:45449: 535 Incorrect authentication data (set_id=comercial@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.75.130.182
country_id: 3895114
description:
2025-12-30 18:38:01 dovecot_plain authenticator failed for H=([89.116.164.85]) [181.75.130.182]:58695: 535 Incorrect authentication data (set_id=comercial@kamechotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 30 18:39:08 host2 sshd[1968559]: Disconnected from invalid user daisy 186.248.197.77 port 16658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.125.94.71
country_id: 1643084
description:
Dec 30 18:38:14 host2 sshd[1967747]: Disconnected from invalid user milad 202.125.94.71 port 37498 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.134.230.169
country_id: 6252001
description:
[2025-12-30 18:38:35 +0530] info [whostmgrd] 76.134.230.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.41.218.40
country_id: 6252001
description:
[2025-12-30 18:39:32 +0530] info [whostmgrd] 66.41.218.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.210.55.81
country_id: 2077456
description:
Dec 30 18:39:53 host2 sshd[1969156]: Disconnected from invalid user soc 13.210.55.81 port 51232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:39:58 host2 sshd[1969227]: Disconnected from invalid user bot 197.211.55.20 port 50210 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 18:40:29 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MSlQFStH0tsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2025-12-30 18:40:51 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:45326: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 30 18:41:10 host2 sshd[1970653]: Disconnected from invalid user webmaster 186.248.197.77 port 25986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:41:15 host2 sshd[1970698]: Disconnected from invalid user casaos 197.211.55.20 port 52446 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 30 18:41:57 host2 sshd[1971184]: Received disconnect from 158.69.194.34 port 48194:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-30 18:42:03 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:2493: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 30 18:42:55 host2 sshd[1971836]: Disconnected from invalid user postgres 158.69.194.34 port 55370 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 30 18:43:07 host2 sshd[1971979]: Disconnected from invalid user deployer 197.211.55.20 port 56082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-30 18:42:24 dovecot_login authenticator failed for H=(128.102.88.80.sta.ac-net.se) [80.88.102.128]:39752: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.229.72.68
country_id: 1605651
description:
Dec 30 18:43:14 host2 sshd[1972065]: Disconnected from invalid user kodi 49.229.72.68 port 59038 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.121.121.27
country_id: 6252001
description:
[2025-12-30 18:43:23 +0530] info [whostmgrd] 38.121.121.27 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 30 18:43:24 host2 sshd[1972196]: Disconnected from invalid user deploy 158.69.194.34 port 33930 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.60.242.234
country_id: 6252001
description:
[2025-12-30 18:43:39 +0530] info [whostmgrd] 184.60.242.234 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-30 18:44:27 dovecot_login authenticator failed for H=([182.95.20.28]) [182.95.228.10]:50804: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:45:08 host2 sshd[1973693]: Disconnected from invalid user oper 187.210.77.100 port 53000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-30 18:44:14 dovecot_login authenticator failed for H=([193.23.199.238]) [193.23.199.238]:38300: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.210.55.81
country_id: 2077456
description:
Dec 30 18:44:24 host2 sshd[1973014]: Disconnected from invalid user deploy 13.210.55.81 port 56656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 18:47:44 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<UhhILytHDhpo7MS0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.193.120.58
country_id: 6252001
description:
[2025-12-30 18:47:54 +0530] info [whostmgrd] 108.193.120.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.111.251.118
country_id: 6252001
description:
[2025-12-30 18:48:08 +0530] info [whostmgrd] 24.111.251.118 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:48:25 host2 sshd[1976809]: Disconnected from invalid user next 187.210.77.100 port 42288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2025-12-30 18:48:41 dovecot_login authenticator failed for H=([41.59.99.40]) [41.59.99.40]:56260: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-30 18:48:57 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:53621: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:49:49 host2 sshd[1977901]: Disconnected from invalid user storage 187.210.77.100 port 45846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:51:09 host2 sshd[1979100]: Disconnected from invalid user fabio 187.210.77.100 port 46720 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.131.144
country_id: 6252001
description:
[2025-12-30 18:52:11 +0530] info [whostmgrd] 216.49.131.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 18:51:14 host2 sshd[1979157]: Disconnected from invalid user nick 62.60.131.157 port 16752 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 18:51:47 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<fTCxPStHUuei8GQy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.112.126.121
country_id: 6252001
description:
[2025-12-30 18:51:51 +0530] info [whostmgrd] 23.112.126.121 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 30 18:52:27 host2 sshd[1980188]: Disconnected from invalid user bounce 187.210.77.100 port 46698 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.203.35
country_id: 2542007
description:
[2025-12-30 18:52:37 +0530] info [cpaneld] 197.147.203.35 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 197.147.203.35
country_id: 2542007
description:
[2025-12-30 18:52:46 +0530] info [cpaneld] 197.147.203.35 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user travel (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 197.147.203.35
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[197.147.203.35] [Remote Port]=[12445] [Authentication Database]=[system] [Username]=[travel] (5/5 failures) (blocked until [Tue Dec 30 13:37:42 2025 UTC/Tue Dec 30 19:07:42 2025 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.234.200
country_id: 6252001
description:
[2025-12-30 18:54:06 +0530] info [whostmgrd] 107.136.234.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.212.188
country_id: 1269750
description:
Dec 30 18:54:07 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=43.225.212.188, lip=66.85.158.91, TLS, session=<pTsWRStH0Jcr4dS8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 18:53:27 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fPeoQytHhJFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.202.96.252
country_id: 3865483
description:
Dec 30 18:53:46 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=143.202.96.252, lip=66.85.158.91, TLS, session=<HGDeQytHqs2PymD8>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.174.144.123
country_id: 6252001
description:
[2025-12-30 18:53:51 +0530] info [whostmgrd] 69.174.144.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.141.49.18
country_id: 2260494
description:
2025-12-30 18:55:10 dovecot_plain authenticator failed for H=([89.116.164.85]) [102.141.49.18]:47580: 535 Incorrect authentication data (set_id=hello@kamechotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 18:55:34 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<76pDSytHGIdn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.166.62.220
country_id: 298795
description:
2025-12-30 18:55:39 dovecot_plain authenticator failed for H=([89.116.164.85]) [78.166.62.220]:26366: 535 Incorrect authentication data (set_id=hello@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 18:55:44 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<CCToSytHapcjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.141.49.18
country_id: 2260494
description:
2025-12-30 18:55:17 dovecot_login authenticator failed for H=([89.116.164.85]) [102.141.49.18]:47580: 535 Incorrect authentication data (set_id=hello@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.234.221.192
country_id: 878675
description:
2025-12-30 18:55:24 dovecot_plain authenticator failed for H=([89.116.164.85]) [216.234.221.192]:16600: 535 Incorrect authentication data (set_id=hello@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-30 18:56:51 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (sivellency) [24.98.45.238]:54924: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-30 18:56:55 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (decting) [73.230.86.50]:40374: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 18:57:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<VfgkUStHEOyeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-30 18:57:42 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:36768: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.199
country_id: 2186224
description:
2025-12-30 18:58:15 dovecot_login authenticator failed for H=([121.73.166.199]) [121.73.166.199]:58396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.115.151.101
country_id: 6252001
description:
[2025-12-30 18:59:21 +0530] info [whostmgrd] 107.115.151.101 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 19:00:58 host2 pure-ftpd[1988970]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-30 19:01:06 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:35626: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.195.221.26
country_id: 934292
description:
Dec 30 19:00:37 host2 sshd[1988531]: Disconnected from invalid user bitrix 45.195.221.26 port 45926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 19:00:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<VzhqXitHNtUyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.27.97.172
country_id: 3439705
description:
Dec 30 19:01:49 host2 sshd[1989729]: Disconnecting invalid user admin 179.27.97.172 port 54042: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 179.27.97.172
country_id: 3439705
description:
Dec 30 19:01:34 host2 sshd[1989436]: Disconnecting authenticating user root 179.27.97.172 port 35950: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 179.27.97.172
country_id: 3439705
description:
Dec 30 19:01:34 host2 sshd[1989436]: error: maximum authentication attempts exceeded for root from 179.27.97.172 port 35950 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.122.72.90
country_id: 6252001
description:
[2025-12-30 19:02:34 +0530] info [whostmgrd] 76.122.72.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2025-12-30 19:02:50 +0530] info [cpaneld] 45.168.113.8 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.125.117.123
country_id: 6252001
description:
[2025-12-30 19:03:05 +0530] info [whostmgrd] 172.125.117.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 19:04:10 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<2moMaitHtCai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 19:05:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<bYEvbitHFOIzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.10
country_id: 1733045
description:
2025-12-30 19:05:45 dovecot_login authenticator failed for H=([49.124.151.10]) [49.124.151.10]:38578: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 19:05:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<UsA5cCtHpsIv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.184.121.111
country_id: 6252001
description:
[2025-12-30 19:06:05 +0530] info [whostmgrd] 209.184.121.111 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-30 19:06:09 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:43194: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-30 19:06:29 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (criony) [98.203.34.136]:48688: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-30 19:06:39 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:50334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-30 19:06:56 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:60434: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-30 19:07:18 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:49181: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.42
country_id: 3469034
description:
Dec 30 19:07:22 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.8.251.42, lip=66.85.158.91, TLS, session=<rpiGdCtHHtmxCPsq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.230
country_id: 2510769
description:
Dec 30 19:07:41 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.74.240.230, lip=66.85.158.91, TLS, session=<UqawdStHQ7W5SvDm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.246.106.59
country_id: 6252001
description:
[2025-12-30 19:09:11 +0530] info [whostmgrd] 64.246.106.59 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-30 19:09:33 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:53196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 19:09:38 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<oWqQfStHlJEzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-30 19:10:09 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:36584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-30 19:10:36 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [200.89.159.59]:38866: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Dec 30 19:10:38 host2 sshd[1997679]: Disconnected from invalid user userb 38.213.63.12 port 53650 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 19:11:26 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<BLUMhCtHHoIv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 30 19:13:55 host2 sshd[2000632]: Disconnected from invalid user deploy 143.198.85.84 port 34162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.242
country_id: 1269750
description:
Dec 30 19:13:51 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.70.126.242, lip=66.85.158.91, TLS, session=<5/heiytHzO1nRn7y>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 2750405
description:
Dec 30 19:14:31 host2 sshd[2001139]: Disconnected from invalid user runner 38.213.63.12 port 42140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 30 19:14:35 host2 sshd[2001124]: Disconnected from invalid user zimbra 103.132.243.250 port 37310 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.91
country_id: 3469034
description:
Dec 30 19:14:20 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<env_eng>, method=PLAIN, rip=187.120.73.91, lip=66.85.158.91, TLS, session=<DMMhjStHOZW7eElb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 30 19:14:23 host2 sshd[2000938]: Disconnected from invalid user usman 27.112.78.245 port 45770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.243.72
country_id: 1643084
description:
Dec 30 19:14:27 host2 sshd[2001056]: Disconnected from invalid user ospite 103.82.243.72 port 48058 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.107.192.144
country_id: 6252001
description:
[2025-12-30 19:14:29 +0530] info [whostmgrd] 73.107.192.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 19:15:43 host2 sshd[2002146]: Disconnected from invalid user admin 2.57.121.112 port 57312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 19:16:14 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<rdEslStHIsBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 19:15:27 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<PZtkkitHUtWeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 30 19:17:13 host2 sshd[2003225]: Disconnected from invalid user azureuser 143.198.85.84 port 55000 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.249.231.110
country_id: 6252001
description:
[2025-12-30 19:17:38 +0530] info [whostmgrd] 96.249.231.110 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.131.109.250
country_id: 6252001
description:
[2025-12-30 19:18:08 +0530] info [whostmgrd] 107.131.109.250 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.172.90.224
country_id: 6252001
description:
[2025-12-30 19:18:16 +0530] info [whostmgrd] 207.172.90.224 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 30 19:18:28 host2 sshd[2004017]: Disconnected from invalid user azureuser 27.112.78.245 port 34390 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.178.120
country_id: 6252001
description:
[2025-12-30 19:18:34 +0530] info [whostmgrd] 216.147.178.120 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 30 19:18:50 host2 sshd[2004231]: Disconnected from invalid user experiment 143.198.85.84 port 36252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 30 19:19:13 host2 sshd[2004485]: Disconnected from invalid user tester 103.132.243.250 port 46226 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.113.37.106
country_id: 6252001
description:
[2025-12-30 19:22:17 +0530] info [whostmgrd] 23.113.37.106 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.144.222.229
country_id: 6252001
description:
[2025-12-30 19:23:25 +0530] info [whostmgrd] 76.144.222.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Dec 30 19:23:31 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<lCxdrytHwk9BMRRC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.115.242.242
country_id: 6252001
description:
[2025-12-30 19:26:24 +0530] info [whostmgrd] 66.115.242.242 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 19:26:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<oyVluytH0LYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 19:27:43 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Fz88vitHtucvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 19:28:28 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<SD/qwCtHFpcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 19:29:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XVPExStHmyNniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.182.224.205
country_id: 3469034
description:
2025-12-30 19:29:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [179.182.224.205]:54798: 535 Incorrect authentication data (set_id=it@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.28.247.60
country_id: 248816
description:
2025-12-30 19:30:07 dovecot_plain authenticator failed for H=([89.116.164.85]) [176.28.247.60]:32949: 535 Incorrect authentication data (set_id=it@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.152.71.194
country_id: 6252001
description:
2025-12-30 19:30:19 dovecot_plain authenticator failed for H=c-73-152-71-194.hsd1.va.comcast.net ([89.116.164.85]) [73.152.71.194]:51254: 535 Incorrect authentication data (set_id=it@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 19:31:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ICAByitHnTd100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.23.82.219
country_id: 6252001
description:
[2025-12-30 19:33:34 +0530] info [whostmgrd] 98.23.82.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.214.133.90
country_id: 6252001
description:
[2025-12-30 19:34:53 +0530] info [whostmgrd] 206.214.133.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 19:36:03 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<3lEX3CtHctGnrKy4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.110.109.174
country_id: 6252001
description:
[2025-12-30 19:35:30 +0530] info [whostmgrd] 74.110.109.174 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.53.184.56
country_id: 6252001
description:
[2025-12-30 19:35:48 +0530] info [whostmgrd] 108.53.184.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.202.33.144
country_id: 6252001
description:
[2025-12-30 19:36:23 +0530] info [whostmgrd] 151.202.33.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:36:26 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<UXeL3StHRsCi2JU5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.222.45.110
country_id: 6252001
description:
[2025-12-30 19:36:44 +0530] info [whostmgrd] 73.222.45.110 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.77.56.10
country_id: 6252001
description:
[2025-12-30 19:36:54 +0530] info [whostmgrd] 38.77.56.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 19:38:39 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ZzpX5StHgI0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:38:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Ff7w5CtH7PKi2JU5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.39.147.217
country_id: 6252001
description:
[2025-12-30 19:38:31 +0530] info [whostmgrd] 108.39.147.217 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:39:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<K0MD6itH6uui2JU5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.165.64.150
country_id: 6252001
description:
[2025-12-30 19:41:18 +0530] info [whostmgrd] 98.165.64.150 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.186.156
country_id: 6252001
description:
Dec 30 19:41:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.186.156, lip=66.85.158.91, session=<hIkh7ytHnocofLqc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.66.55.131
country_id: 6252001
description:
[2025-12-30 19:41:27 +0530] info [whostmgrd] 72.66.55.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.148
country_id: 6252001
description:
[2025-12-30 19:42:21 +0530] info [whostmgrd] 172.58.212.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.57
country_id: 6252001
description:
Dec 30 19:43:01 host2 pure-ftpd[2023282]: (?@167.94.146.57) [INFO] New connection from 167.94.146.57


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 19:44:43 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<lcAP+ytHfrii8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.255.30
country_id: 1168579
description:
2025-12-30 19:44:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [103.163.255.30]:41062: 535 Incorrect authentication data (set_id=accounts@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.133.77.232
country_id: 3469034
description:
2025-12-30 19:45:09 dovecot_plain authenticator failed for H=([89.116.164.85]) [179.133.77.232]:57650: 535 Incorrect authentication data (set_id=accounts@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 19:45:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<pG3U/CtHaOSeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.133.77.232
country_id: 3469034
description:
2025-12-30 19:45:16 dovecot_login authenticator failed for H=([89.116.164.85]) [179.133.77.232]:57650: 535 Incorrect authentication data (set_id=accounts@kamechotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.216.27
country_id: 6252001
description:
[2025-12-30 19:45:56 +0530] info [whostmgrd] 172.59.216.27 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:46:02 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS, session=<ExDn/ytH3uWi2JU5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.182.41.53
country_id: 6252001
description:
[2025-12-30 19:47:06 +0530] info [whostmgrd] 104.182.41.53 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.57
country_id: 6252001
description:
Dec 30 19:47:08 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.57, lip=66.85.158.92, TLS, session=<i7HOAyxHKPKi2JU5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 19:47:32 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<QmUbBSxHvqmYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 19:48:43 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<IoxbCSxHWpFnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 19:50:30 host2 sshd[2034162]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-12-30 19:50:22 dovecot_login authenticator failed for H=(c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:34184: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-30 19:50:46 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:52620: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 19:50:46 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<G0uRECxHlj9o7MS0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.189.81.235
country_id: 6252001
description:
[2025-12-30 19:52:02 +0530] info [whostmgrd] 38.189.81.235 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 19:51:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<owWxFCxHAKNn9M4G>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.48.140.42
country_id: 6252001
description:
[2025-12-30 19:52:15 +0530] info [whostmgrd] 199.48.140.42 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.69.151.196
country_id: 6252001
description:
[2025-12-30 19:53:25 +0530] info [whostmgrd] 173.69.151.196 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 19:53:37 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IejoGixHBr0jupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.217.140.64
country_id: 6252001
description:
[2025-12-30 19:55:07 +0530] info [whostmgrd] 108.217.140.64 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 19:55:18 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<LQDOICxH/JSeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.242.198.163
country_id: 3017382
description:
Dec 30 19:57:59 host2 sshd[2056520]: Disconnected from invalid user oracle 38.242.198.163 port 53054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 30 19:58:04 host2 sshd[2056963]: Disconnected from invalid user ubuntu 207.154.247.4 port 57892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 19:59:27 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 10 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<es9JLyxHXL2eRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.16.134.232
country_id: 6252001
description:
[2025-12-30 20:02:34 +0530] info [whostmgrd] 70.16.134.232 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.189.14.214
country_id: 3469034
description:
2025-12-30 20:02:37 dovecot_plain authenticator failed for H=([89.116.164.85]) [200.189.14.214]:61412: 535 Incorrect authentication data (set_id=noreply@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.67.38.219
country_id: 3469034
description:
2025-12-30 20:02:42 dovecot_plain authenticator failed for H=177-67-38-219.static.newlifeinformatica.com.br ([89.116.164.85]) [177.67.38.219]:2287: 535 Incorrect authentication data (set_id=noreply@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Dec 30 20:02:24 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 36 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<BsBFOCxH0rDE+2YK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 20:02:27 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<6ZctOixH4B2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 20:03:45 host2 sshd[2065635]: Disconnected from invalid user ulysses 62.60.131.157 port 47638 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 20:05:15 host2 pure-ftpd[2067030]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.242.198.163
country_id: 3017382
description:
Dec 30 20:04:23 host2 sshd[2066019]: Disconnected from invalid user user1 38.242.198.163 port 40084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 30 20:05:45 host2 sshd[2067432]: Disconnected from invalid user oracle 12.156.67.18 port 36222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 20:06:04 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZPASRyxHMsOnrKy4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.222.100.203
country_id: 6252001
description:
[2025-12-30 20:06:35 +0530] info [whostmgrd] 47.222.100.203 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 30 20:06:38 host2 sshd[2067962]: Disconnected from invalid user tester 12.156.67.18 port 44542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-30 20:06:44 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (ratedonis) [73.13.220.220]:43762: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.212.113.119
country_id: 6252001
description:
[2025-12-30 20:06:54 +0530] info [whostmgrd] 129.212.113.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.79.87
country_id: 1643084
description:
Dec 30 20:07:32 host2 sshd[2068718]: Disconnected from invalid user user 27.112.79.87 port 43612 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 20:07:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Z3qhTSxHutozTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.220.199.120
country_id: 6252001
description:
[2025-12-30 20:07:31 +0530] info [whostmgrd] 73.220.199.120 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 20:08:48 host2 sshd[2069510]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 20:08:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<VPyLUSxHJNQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 20:09:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<gMbSVCxHYMIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 20:10:09 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<K/T/VSxHHNAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.242.198.163
country_id: 3017382
description:
Dec 30 20:10:29 host2 sshd[2070921]: Disconnected from invalid user ubuntu 38.242.198.163 port 60918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 20:12:07 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<k58QXSxHPIMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 20:13:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<AhvxYCxH0qyeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 30 20:15:22 host2 sshd[2073793]: Disconnected from invalid user ubuntu 12.156.67.18 port 37582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 20:18:07 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<bJtucixHJLRCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.39
country_id: 2635167
description:
Dec 30 20:18:36 host2 pure-ftpd[2076036]: (?@87.236.176.39) [INFO] New connection from 87.236.176.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2025-12-30 20:18:53 dovecot_login authenticator failed for H=([175.156.82.86]) [175.156.82.86]:51599: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.7.17
country_id: 3144096
description:
2025-12-30 20:19:10 dovecot_login authenticator failed for H=([84.211.7.17]) [84.211.7.17]:47454: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.10.162.239
country_id: 2464461
description:
2025-12-30 20:19:51 dovecot_plain authenticator failed for H=([89.116.164.85]) [197.10.162.239]:37790: 535 Incorrect authentication data (set_id=suporte@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.39.141.69
country_id: 3017382
description:
2025-12-30 20:20:03 dovecot_plain authenticator failed for H=31-39-141-69.abo.bbox.fr ([89.116.164.85]) [31.39.141.69]:59832: 535 Incorrect authentication data (set_id=suporte@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.182.249.84
country_id: 3686110
description:
2025-12-30 20:20:14 dovecot_plain authenticator failed for H=([89.116.164.85]) [201.182.249.84]:49603: 535 Incorrect authentication data (set_id=suporte@kamechotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.182.249.84
country_id: 3686110
description:
2025-12-30 20:20:20 dovecot_login authenticator failed for H=([89.116.164.85]) [201.182.249.84]:49603: 535 Incorrect authentication data (set_id=suporte@kamechotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 20:21:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<SBIbgCxHxkpniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.154.247.4
country_id: 2921044
description:
Dec 30 20:23:52 host2 sshd[2079772]: Disconnected from invalid user steam 207.154.247.4 port 50788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 20:25:59 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<EAiojixHUKF100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 20:28:53 host2 sshd[2083170]: Disconnected from invalid user admin 2.57.121.112 port 49241 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 20:28:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60299: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 20:29:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<P6F2nCxHdOkv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 30 20:31:54 host2 sshd[2085237]: Disconnected from invalid user ansible 205.185.115.224 port 32790 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-30 20:32:16 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:49950: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-30 20:32:31 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:42258: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 30 20:33:14 host2 sshd[2086225]: Disconnected from invalid user db2fenc 205.185.115.224 port 59390 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 20:35:51 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<00T0sSxH6G4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 20:36:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<i6ItsyxHDpQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 20:38:13 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pLdiuixHxNai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 20:38:18 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<H+C2uixHht0vWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec 30 20:39:10 host2 sshd[2090532]: Disconnected from invalid user ftpuser 205.185.115.224 port 37920 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.221.255.205
country_id: 6252001
description:
[2025-12-30 20:39:25 +0530] info [cpaneld] 47.221.255.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.208.7.56
country_id: 6252001
description:
[2025-12-30 20:39:24 +0530] info [cpaneld] 152.208.7.56 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.77.59.127
country_id: 6252001
description:
[2025-12-30 20:39:25 +0530] info [cpaneld] 72.77.59.127 - jrdc "GET /login/?login_only=1&user=jrdc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrdc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.109.150.197
country_id: 6252001
description:
[2025-12-30 20:39:29 +0530] info [whostmgrd] 143.109.150.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.120.95.184
country_id: 6252001
description:
[2025-12-30 20:39:30 +0530] info [cpaneld] 23.120.95.184 - jrdclk "GET /login/?login_only=1&user=jrdclk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.100.167
country_id: 6252001
description:
[2025-12-30 20:39:33 +0530] info [cpaneld] 74.105.100.167 - jr "GET /login/?login_only=1&user=jr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.84.30
country_id: 6252001
description:
[2025-12-30 20:39:31 +0530] info [cpaneld] 129.222.84.30 - jrd "GET /login/?login_only=1&user=jrd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrd (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.66.246
country_id: 6252001
description:
Dec 30 20:41:10 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.221.66.246, lip=66.85.158.92, session=<zHYKxSxHgO0U3UL2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 20:43:46 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<W0c6zixHKt1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 20:46:09 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<fNXF1ixHHrdn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.91
country_id: 6252001
description:
Dec 30 20:46:40 host2 pure-ftpd[2096139]: (?@205.210.31.91) [INFO] New connection from 205.210.31.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-30 20:46:56 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (ingistufor) [98.204.134.124]:35466: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.211
country_id: 3017382
description:
Dec 30 20:48:00 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.211, lip=66.85.158.92, session=<AwR53SxH68NbxJjT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.210
country_id: 3017382
description:
Dec 30 20:48:13 host2 dovecot[1836975]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.210, lip=66.85.158.92, session=<h8pE3ixHW7ZbxJjS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.214
country_id: 3017382
description:
Dec 30 20:47:49 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.214, lip=66.85.158.92, session=<kcXb3CxHYZ1bxJjW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.177
country_id: 3017382
description:
Dec 30 20:48:16 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.177, lip=66.85.158.92, session=<GDh33ixHB4FbxJix>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2025-12-30 20:49:40 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:41010: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-30 20:49:51 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:54978: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec 30 20:51:13 host2 sshd[2099677]: Disconnected from invalid user tester 45.249.247.165 port 39770 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 20:50:54 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6sio5yxHyKEjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 30 20:51:10 host2 sshd[2099674]: Disconnected from invalid user user 103.144.247.233 port 47450 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.2.119.101
country_id: 6252001
description:
[2025-12-30 20:52:02 +0530] info [cpaneld] 104.2.119.101 - dandagamuwalk "GET /login/?login_only=1&user=dandagamuwalk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuwalk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.234.184
country_id: 6252001
description:
[2025-12-30 20:52:07 +0530] info [cpaneld] 45.31.234.184 - dand "GET /login/?login_only=1&user=dand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.89.221.240
country_id: 6252001
description:
[2025-12-30 20:52:09 +0530] info [cpaneld] 74.89.221.240 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.76.253
country_id: 6252001
description:
[2025-12-30 20:52:11 +0530] info [cpaneld] 129.222.76.253 - dandaga1 "GET /login/?login_only=1&user=dandaga1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 30 20:51:24 host2 sshd[2099846]: Disconnected from invalid user admin 52.237.80.79 port 53278 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.253.191.249
country_id: 6252001
description:
[2025-12-30 20:51:57 +0530] info [cpaneld] 73.253.191.249 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.98.143
country_id: 6252001
description:
[2025-12-30 20:52:06 +0530] info [cpaneld] 172.59.98.143 - danda "GET /login/?login_only=1&user=danda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user danda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.137.189.167
country_id: 6252001
description:
[2025-12-30 20:52:12 +0530] info [cpaneld] 73.137.189.167 - dandaga2 "GET /login/?login_only=1&user=dandaga2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.231.65.198
country_id: 6252001
description:
[2025-12-30 20:52:01 +0530] info [whostmgrd] 69.231.65.198 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.69.85.132
country_id: 6252001
description:
[2025-12-30 20:52:05 +0530] info [cpaneld] 68.69.85.132 - dandag "GET /login/?login_only=1&user=dandag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.2.254.71
country_id: 6252001
description:
[2025-12-30 20:52:04 +0530] info [cpaneld] 68.2.254.71 - dandaga "GET /login/?login_only=1&user=dandaga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.252.151.43
country_id: 6252001
description:
[2025-12-30 20:52:08 +0530] info [cpaneld] 73.252.151.43 - dan "GET /login/?login_only=1&user=dan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.113.251.51
country_id: 6252001
description:
[2025-12-30 20:51:56 +0530] info [cpaneld] 207.113.251.51 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.115.181
country_id: 6252001
description:
[2025-12-30 20:52:00 +0530] info [cpaneld] 108.66.115.181 - dandagamuwa "GET /login/?login_only=1&user=dandagamuwa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuwa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.197.204.218
country_id: 6252001
description:
[2025-12-30 20:52:03 +0530] info [cpaneld] 72.197.204.218 - dandagam "GET /login/?login_only=1&user=dandagam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 20:52:34 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<8Ye87SxH+qOeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 30 20:52:34 host2 sshd[2100593]: Disconnected from invalid user dell 52.237.80.79 port 49070 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 30 20:52:39 host2 sshd[2100654]: Received disconnect from 103.144.247.233 port 53874:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 20:52:39 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<iQsC7ixHwKdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Dec 30 20:54:16 host2 sshd[2102196]: Disconnected from invalid user sysadmin 102.211.152.138 port 41784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec 30 20:54:32 host2 sshd[2102387]: Disconnected from invalid user github 45.249.247.165 port 43914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.247.165
country_id: 1819730
description:
Dec 30 20:55:14 host2 sshd[2103056]: Disconnected from invalid user deployer 45.249.247.165 port 57014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.186
country_id: 226074
description:
Dec 30 20:56:45 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=196.0.119.186, lip=66.85.158.91, TLS, session=<f/Gw+yxHhLnEAHe6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.112.138
country_id: 3865483
description:
Dec 30 20:57:10 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=190.110.112.138, lip=66.85.158.91, TLS, session=<KVEE/SxHu9O+bnCK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-30 20:57:22 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:38619: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-30 20:57:55 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:51240: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 20:59:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<q+N+Bi1HRIWi8Jp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.165.104
country_id: 6252001
description:
[2025-12-30 21:01:01 +0530] info [cpaneld] 67.188.165.104 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.148
country_id: 6252001
description:
[2025-12-30 21:01:03 +0530] info [whostmgrd] 172.58.212.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.233.170
country_id: 6252001
description:
[2025-12-30 21:01:11 +0530] info [cpaneld] 68.7.233.170 - mon "GET /login/?login_only=1&user=mon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.255.92.255
country_id: 6252001
description:
[2025-12-30 21:01:00 +0530] info [cpaneld] 68.255.92.255 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.140.11
country_id: 6252001
description:
[2025-12-30 21:01:02 +0530] info [cpaneld] 108.66.140.11 - monarchdss "GET /login/?login_only=1&user=monarchdss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.34.10.131
country_id: 6252001
description:
[2025-12-30 21:01:08 +0530] info [cpaneld] 100.34.10.131 - monar "GET /login/?login_only=1&user=monar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.204.240.105
country_id: 6252001
description:
[2025-12-30 21:01:14 +0530] info [cpaneld] 162.204.240.105 - monarch2 "GET /login/?login_only=1&user=monarch2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.181.57.46
country_id: 6252001
description:
[2025-12-30 21:01:13 +0530] info [cpaneld] 73.181.57.46 - monarch1 "GET /login/?login_only=1&user=monarch1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.141.48
country_id: 6252001
description:
[2025-12-30 21:01:07 +0530] info [cpaneld] 184.179.141.48 - monarc "GET /login/?login_only=1&user=monarc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.182.214.174
country_id: 6252001
description:
[2025-12-30 21:01:09 +0530] info [cpaneld] 97.182.214.174 - mona "GET /login/?login_only=1&user=mona&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mona (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.165.13
country_id: 6252001
description:
[2025-12-30 21:01:12 +0530] info [cpaneld] 98.97.165.13 - mo "GET /login/?login_only=1&user=mo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.174.209.184
country_id: 6252001
description:
[2025-12-30 21:01:04 +0530] info [cpaneld] 140.174.209.184 - monarchdsscom "GET /login/?login_only=1&user=monarchdsscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarchdsscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.79.241.91
country_id: 6252001
description:
[2025-12-30 21:01:06 +0530] info [cpaneld] 108.79.241.91 - monarch "GET /login/?login_only=1&user=monarch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.138.49
country_id: 6252001
description:
[2025-12-30 21:01:05 +0530] info [cpaneld] 140.228.138.49 - monarchd "GET /login/?login_only=1&user=monarchd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarchd (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 21:06:04 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<PH73HS1HONSYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Dec 30 21:07:49 host2 sshd[2114920]: Disconnected from invalid user chaitanya 45.78.201.248 port 42320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 21:09:02 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<HlOfKC1HfpWnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.150.217.20
country_id: 3017382
description:
Dec 30 21:08:20 host2 sshd[2115388]: Disconnected from invalid user wanghao 83.150.217.20 port 42186 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 21:08:58 host2 pure-ftpd[2115924]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 21:09:40 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0aDiKi1HuLAv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2025-12-30 21:09:52 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:33512: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.180.151
country_id: 2802361
description:
Dec 30 21:09:55 host2 pure-ftpd[2117150]: (?@35.195.180.151) [INFO] New connection from 35.195.180.151


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 30 21:09:17 host2 sshd[2116268]: Disconnected from invalid user ai 38.137.11.10 port 10952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 21:10:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<cytVLS1HYrMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 21:10:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ZrPZLS1HdKCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.226
country_id: 798544
description:
Dec 30 21:10:57 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.231.121.226, lip=66.85.158.91, TLS, session=<gX2VLi1Ht6Zb53ni>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 21:10:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<hy9ALS1HlJGeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-30 21:10:23 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:44987: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.237
country_id: 3469034
description:
Dec 30 21:10:29 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.120.73.237, lip=66.85.158.91, TLS, session=<cgzaLC1HnKm7eEnt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 21:11:23 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<V7sEMS1Hpt8v/AU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:14:06 host2 sshd[2121600]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.230.102.130
country_id: 3996063
description:
Dec 30 21:13:27 host2 sshd[2120991]: Disconnected from invalid user flash 187.230.102.130 port 36362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:13:45 host2 sshd[2121429]: Disconnected from invalid user ubuntu 168.197.99.226 port 60894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 21:14:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7J2yOi1HTwtniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:14:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<2BG7Oy1HG8+i2JYl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.150.217.20
country_id: 3017382
description:
Dec 30 21:14:38 host2 sshd[2122314]: Disconnected from invalid user frappe 83.150.217.20 port 47362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 21:14:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<rn3QPC1HTLgzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:14:55 host2 sshd[2122690]: Disconnected from invalid user ai 168.197.99.226 port 52372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.28.8
country_id: 3017382
description:
Dec 30 21:15:12 host2 sshd[2123144]: Disconnected from invalid user bbs 51.178.28.8 port 38372 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:15:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<lHH+Pi1HYu6i2JYl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:15:29 host2 sshd[2123462]: Disconnected from invalid user ts 168.197.99.226 port 43152 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.119.29.137
country_id: 6252001
description:
Dec 30 21:16:14 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=40.119.29.137, lip=66.85.158.91, TLS, session=<oAZwQi1Hrooodx2J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.28.8
country_id: 3017382
description:
Dec 30 21:16:15 host2 sshd[2124294]: Disconnected from invalid user vpn 51.178.28.8 port 44266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 30 21:17:37 host2 sshd[2125962]: Disconnected from invalid user deploy 165.232.178.116 port 49434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 21:17:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<PDcGSC1HnoIyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-30 21:17:58 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:40138: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 30 21:17:59 host2 sshd[2126360]: Disconnected from invalid user ubuntu 38.137.11.10 port 36036 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.47.111
country_id: 6252001
description:
Dec 30 21:18:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.29.47.111, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<d+KmSy1HsKIUHS9v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-30 21:18:15 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:42801: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 30 21:18:17 host2 sshd[2126798]: Disconnected from invalid user cristian 165.232.178.116 port 45862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:19:54 host2 sshd[2128937]: Disconnected from invalid user soporte 189.217.130.86 port 36409 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 21:20:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<5zv4US1HlI9CdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.115.157.22
country_id: 6252001
description:
[2025-12-30 21:20:50 +0530] info [cpaneld] 99.115.157.22 - euroent "GET /login/?login_only=1&user=euroent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:20:17 host2 sshd[2129773]: Disconnected from invalid user akshay 159.198.32.61 port 49220 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.76.154.205
country_id: 6252001
description:
[2025-12-30 21:20:46 +0530] info [whostmgrd] 108.76.154.205 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.179.50.142
country_id: 6252001
description:
[2025-12-30 21:20:45 +0530] info [cpaneld] 71.179.50.142 - euroentertainmentlk "GET /login/?login_only=1&user=euroentertainmentlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.92.235.130
country_id: 6252001
description:
[2025-12-30 21:20:49 +0530] info [cpaneld] 168.92.235.130 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.26.30
country_id: 6252001
description:
[2025-12-30 21:20:56 +0530] info [cpaneld] 98.97.26.30 - euro "GET /login/?login_only=1&user=euro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euro (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:20:11 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS, session=<M+qVUC1HOvqi2JYl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.240.154
country_id: 6252001
description:
[2025-12-30 21:20:42 +0530] info [cpaneld] 140.186.240.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.251.185.32
country_id: 6252001
description:
[2025-12-30 21:20:43 +0530] info [cpaneld] 108.251.185.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.117.101.175
country_id: 6252001
description:
[2025-12-30 21:20:53 +0530] info [cpaneld] 75.117.101.175 - euroen "GET /login/?login_only=1&user=euroen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.138.96.170
country_id: 6252001
description:
[2025-12-30 21:20:58 +0530] info [cpaneld] 76.138.96.170 - eu "GET /login/?login_only=1&user=eu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.195.77.134
country_id: 6252001
description:
[2025-12-30 21:21:00 +0530] info [cpaneld] 206.195.77.134 - euroent2 "GET /login/?login_only=1&user=euroent2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.226.242
country_id: 6252001
description:
[2025-12-30 21:20:48 +0530] info [cpaneld] 172.59.226.242 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.238.51.162
country_id: 6252001
description:
[2025-12-30 21:20:54 +0530] info [cpaneld] 96.238.51.162 - euroe "GET /login/?login_only=1&user=euroe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.122.234.75
country_id: 6252001
description:
[2025-12-30 21:20:57 +0530] info [cpaneld] 76.122.234.75 - eur "GET /login/?login_only=1&user=eur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.235.5.116
country_id: 6252001
description:
[2025-12-30 21:20:59 +0530] info [cpaneld] 162.235.5.116 - euroent1 "GET /login/?login_only=1&user=euroent1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 21:21:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<sdYdVC1HjZx100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:21:22 host2 sshd[2130843]: Disconnected from invalid user automation 159.198.32.61 port 44204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:22:59 host2 sshd[2132072]: Disconnected from invalid user dev 57.128.237.234 port 48788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:23:31 host2 sshd[2132437]: Disconnected from invalid user soporte 159.198.32.61 port 34164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:23:36 host2 sshd[2132472]: Disconnected from invalid user user 194.233.74.228 port 42278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:23:43 host2 sshd[2132558]: Disconnected from invalid user pwserver 189.217.130.86 port 47512 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.143
country_id: 6252001
description:
Dec 30 21:24:04 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.188.143, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CBd7Xi1HcqEs3LyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 30 21:24:05 host2 sshd[2132821]: Disconnected from invalid user fy 51.89.166.236 port 55530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:24:19 host2 sshd[2132993]: Disconnected from invalid user ubuntu 189.217.130.86 port 26448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:24:57 host2 sshd[2133394]: Disconnected from invalid user ubuntu 189.217.130.86 port 16915 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 21:25:01 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<1cvEYS1HerSeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:26:09 host2 sshd[2134442]: Disconnected from invalid user minecraft 189.217.130.86 port 41965 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.137.92.76
country_id: 6252001
description:
[2025-12-30 21:26:24 +0530] info [whostmgrd] 107.137.92.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.173.110.145
country_id: 6252001
description:
[2025-12-30 21:26:33 +0530] info [cpaneld] 70.173.110.145 - aj "GET /login/?login_only=1&user=aj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.199.205.184
country_id: 6252001
description:
[2025-12-30 21:26:25 +0530] info [cpaneld] 71.199.205.184 - ajsstarlogcom "GET /login/?login_only=1&user=ajsstarlogcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarlogcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.234.145.171
country_id: 6252001
description:
[2025-12-30 21:26:27 +0530] info [cpaneld] 69.234.145.171 - ajsstar "GET /login/?login_only=1&user=ajsstar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.64.76.91
country_id: 6252001
description:
[2025-12-30 21:26:30 +0530] info [cpaneld] 108.64.76.91 - ajsst "GET /login/?login_only=1&user=ajsst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.242.122.25
country_id: 6252001
description:
[2025-12-30 21:26:33 +0530] info [cpaneld] 97.242.122.25 - ajs "GET /login/?login_only=1&user=ajs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajs (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.63.241.40
country_id: 6252001
description:
[2025-12-30 21:26:35 +0530] info [cpaneld] 96.63.241.40 - ajsstar2 "GET /login/?login_only=1&user=ajsstar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec 30 21:26:51 host2 sshd[2135116]: Disconnected from invalid user joao 45.144.233.139 port 46012 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.102.186.210
country_id: 6252001
description:
[2025-12-30 21:26:21 +0530] info [cpaneld] 199.102.186.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.224.188.153
country_id: 6252001
description:
[2025-12-30 21:26:22 +0530] info [cpaneld] 167.224.188.153 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.46.182.59
country_id: 6252001
description:
[2025-12-30 21:26:26 +0530] info [cpaneld] 75.46.182.59 - ajsstarl "GET /login/?login_only=1&user=ajsstarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.31.86.126
country_id: 6252001
description:
[2025-12-30 21:26:31 +0530] info [cpaneld] 75.31.86.126 - ajss "GET /login/?login_only=1&user=ajss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Dec 30 21:26:41 host2 sshd[2134987]: Disconnected from invalid user aman 45.169.128.70 port 55634 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.111.198.218
country_id: 6252001
description:
[2025-12-30 21:26:23 +0530] info [cpaneld] 98.111.198.218 - ajsstarlog "GET /login/?login_only=1&user=ajsstarlog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.161.142.65
country_id: 6252001
description:
[2025-12-30 21:26:30 +0530] info [cpaneld] 98.161.142.65 - ajssta "GET /login/?login_only=1&user=ajssta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.222.14.68
country_id: 6252001
description:
[2025-12-30 21:26:34 +0530] info [cpaneld] 162.222.14.68 - ajsstar1 "GET /login/?login_only=1&user=ajsstar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Dec 30 21:27:25 host2 sshd[2135534]: Disconnected from invalid user git 45.169.128.70 port 42164 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:27:58 host2 sshd[2135884]: Received disconnect from 57.128.237.234 port 45684:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 30 21:27:13 host2 sshd[2135384]: Disconnected from invalid user ai 51.89.166.236 port 53144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec 30 21:27:20 host2 sshd[2135479]: Disconnected from invalid user fy 45.144.233.139 port 39046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:27:31 host2 sshd[2135614]: Disconnected from invalid user tina 57.128.237.234 port 56302 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.95
country_id: 6252001
description:
Dec 30 21:27:58 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.95, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Y+F0bC1HZ+lAPsVf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:29:00 host2 sshd[2136620]: Disconnected from invalid user ironman 194.233.74.228 port 48672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.92
country_id: 6252001
description:
Dec 30 21:28:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.92, lip=66.85.158.91, TLS handshaking: Connection closed, session=<O6qDbS1HqoBAPsVc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:28:19 host2 sshd[2136171]: Disconnected from invalid user ubuntu 194.233.74.228 port 44614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:28:26 host2 sshd[2136233]: Disconnected from invalid user ftptest 57.128.237.234 port 49302 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 30 21:29:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<AXgHcS1HQJLE+2YV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 21:30:31 host2 sshd[2137840]: Disconnected from invalid user user 2.57.121.25 port 14651 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 21:31:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rHVLeS1H0OWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 21:32:08 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<X8c0ey1HHoUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 21:33:04 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<vX2Rfi1H7HojupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:36:24 host2 sshd[2143790]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 21:39:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<YfjKky1Hep1nmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:39:39 host2 sshd[2146233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 21:39:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<u0UIly1HPJunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-30 21:40:12 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:58724: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 21:40:23 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Gfy8mC1HkLxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.199
country_id: 2186224
description:
2025-12-30 21:40:32 dovecot_login authenticator failed for H=([121.73.166.199]) [121.73.166.199]:56608: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.82.9.177
country_id: 6252001
description:
[2025-12-30 21:41:29 +0530] info [cpaneld] 192.82.9.177 - greenta1 "GET /login/?login_only=1&user=greenta1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.114.56.3
country_id: 6252001
description:
[2025-12-30 21:41:28 +0530] info [cpaneld] 71.114.56.3 - gr "GET /login/?login_only=1&user=gr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.209.92.59
country_id: 6252001
description:
[2025-12-30 21:41:13 +0530] info [cpaneld] 97.209.92.59 - greentaraceylon "GET /login/?login_only=1&user=greentaraceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.84.11.203
country_id: 6252001
description:
[2025-12-30 21:41:18 +0530] info [cpaneld] 135.84.11.203 - greenta "GET /login/?login_only=1&user=greenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.107.206
country_id: 6252001
description:
[2025-12-30 21:41:24 +0530] info [cpaneld] 172.56.107.206 - green "GET /login/?login_only=1&user=green&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user green (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.48.136.53
country_id: 6252001
description:
[2025-12-30 21:41:27 +0530] info [cpaneld] 173.48.136.53 - gre "GET /login/?login_only=1&user=gre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.22.235
country_id: 6252001
description:
[2025-12-30 21:41:15 +0530] info [whostmgrd] 73.241.22.235 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.167.116.23
country_id: 6252001
description:
[2025-12-30 21:41:26 +0530] info [cpaneld] 73.167.116.23 - gree "GET /login/?login_only=1&user=gree&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.2.149.7
country_id: 6252001
description:
[2025-12-30 21:41:11 +0530] info [cpaneld] 172.2.149.7 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.11.122.165
country_id: 6252001
description:
[2025-12-30 21:41:12 +0530] info [cpaneld] 73.11.122.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.107.199
country_id: 6252001
description:
[2025-12-30 21:41:16 +0530] info [cpaneld] 50.5.107.199 - greentaraceyloncom "GET /login/?login_only=1&user=greentaraceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.52.122.124
country_id: 6252001
description:
[2025-12-30 21:41:22 +0530] info [cpaneld] 184.52.122.124 - greent "GET /login/?login_only=1&user=greent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.45.106.159
country_id: 6252001
description:
[2025-12-30 21:41:17 +0530] info [cpaneld] 108.45.106.159 - greentar "GET /login/?login_only=1&user=greentar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.104.175.64
country_id: 6252001
description:
[2025-12-30 21:41:30 +0530] info [cpaneld] 99.104.175.64 - greenta2 "GET /login/?login_only=1&user=greenta2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 21:44:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<6FwUqC1HVs8FhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:45:57 host2 sshd[2151496]: Disconnected from invalid user cherry 187.120.37.209 port 25458 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 30 21:47:17 host2 sshd[2152336]: Disconnected from invalid user deluge 103.52.115.25 port 59460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 21:47:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VvA0sy1HynYjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:48:27 host2 sshd[2154069]: Disconnected from invalid user test1 187.33.59.116 port 35666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-30 21:48:46 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:50600: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2025-12-30 21:49:04 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:48314: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 21:49:38 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<CwzIuS1HdtQvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:49:16 host2 sshd[2154928]: Disconnected from invalid user artur 187.120.37.209 port 24821 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 21:49:33 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<A4aCuS1HzoCeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:50:36 host2 sshd[2168044]: Disconnected from invalid user de 187.120.37.209 port 24677 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:51:24 host2 sshd[2168635]: Disconnected from invalid user elasticsearch 187.33.59.116 port 58121 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.175.2
country_id: 6252001
description:
[2025-12-30 21:52:46 +0530] info [whostmgrd] 67.187.175.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.75.103.249
country_id: 6252001
description:
[2025-12-30 21:52:50 +0530] info [cpaneld] 38.75.103.249 - neotechl "GET /login/?login_only=1&user=neotechl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.204.248.136
country_id: 6252001
description:
[2025-12-30 21:52:59 +0530] info [cpaneld] 104.204.248.136 - ne "GET /login/?login_only=1&user=ne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.90.45.189
country_id: 6252001
description:
[2025-12-30 21:52:58 +0530] info [cpaneld] 75.90.45.189 - neo "GET /login/?login_only=1&user=neo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.238.230.8
country_id: 6252001
description:
[2025-12-30 21:52:43 +0530] info [cpaneld] 76.238.230.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.98.152
country_id: 6252001
description:
[2025-12-30 21:52:47 +0530] info [cpaneld] 24.4.98.152 - neotechlkcom "GET /login/?login_only=1&user=neotechlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.39.155.2
country_id: 6252001
description:
[2025-12-30 21:52:41 +0530] info [cpaneld] 75.39.155.2 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.47.173
country_id: 6252001
description:
[2025-12-30 21:52:54 +0530] info [cpaneld] 73.158.47.173 - neote "GET /login/?login_only=1&user=neote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.55.255.21
country_id: 6252001
description:
[2025-12-30 21:52:55 +0530] info [cpaneld] 75.55.255.21 - neot "GET /login/?login_only=1&user=neot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.144.1.14
country_id: 6252001
description:
[2025-12-30 21:52:44 +0530] info [cpaneld] 24.144.1.14 - neotechlk "GET /login/?login_only=1&user=neotechlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.141.79
country_id: 6252001
description:
[2025-12-30 21:52:51 +0530] info [cpaneld] 108.46.141.79 - neotech "GET /login/?login_only=1&user=neotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.68.205.13
country_id: 6252001
description:
[2025-12-30 21:52:52 +0530] info [cpaneld] 99.68.205.13 - neotec "GET /login/?login_only=1&user=neotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 21:54:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cZuayi1H1mto7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:55:01 host2 sshd[2171604]: Disconnected from invalid user ftpuser 187.33.59.116 port 60595 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:55:44 host2 sshd[2172231]: Disconnected from invalid user deployer 187.33.59.116 port 38502 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 21:56:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<mgrx0C1Hjk6i8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:57:47 host2 sshd[2173562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.157
country_id: 1880251
description:
Dec 30 22:03:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.157, lip=66.85.158.92, session=<AAYU6i1HPYxe586d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.207
country_id: 1880251
description:
Dec 30 22:03:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=94.231.206.207, lip=66.85.158.92, session=<2oi26i1HKcFe587P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.153
country_id: 1880251
description:
Dec 30 22:03:33 host2 dovecot[1836975]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.153, lip=66.85.158.92, session=<rGm16y1Hd6le586Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.152
country_id: 1880251
description:
Dec 30 22:03:37 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.152, lip=66.85.158.92, session=<733s6y1Hr7Ve586Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 22:05:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<6xIG9C1HQi1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 22:07:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<BYje+C1HjI2eRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.122.47.228
country_id: 6252001
description:
[2025-12-30 22:08:29 +0530] info [cpaneld] 216.122.47.228 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.103.113.86
country_id: 6252001
description:
[2025-12-30 22:08:33 +0530] info [whostmgrd] 137.103.113.86 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.241.161.31
country_id: 6252001
description:
[2025-12-30 22:08:36 +0530] info [cpaneld] 173.241.161.31 - ahavafo "GET /login/?login_only=1&user=ahavafo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.101.43.114
country_id: 6252001
description:
[2025-12-30 22:08:38 +0530] info [cpaneld] 216.101.43.114 - ahavaf "GET /login/?login_only=1&user=ahavaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavaf (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 22:08:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<2AaZ/C1H0pAv+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.154.2.144
country_id: 6252001
description:
[2025-12-30 22:08:30 +0530] info [cpaneld] 149.154.2.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.5.149
country_id: 6252001
description:
[2025-12-30 22:08:43 +0530] info [cpaneld] 38.194.5.149 - ah "GET /login/?login_only=1&user=ah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.39.108
country_id: 6252001
description:
[2025-12-30 22:08:45 +0530] info [cpaneld] 98.97.39.108 - ahavafo2 "GET /login/?login_only=1&user=ahavafo2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.255.11.99
country_id: 6252001
description:
[2025-12-30 22:08:39 +0530] info [cpaneld] 96.255.11.99 - ahava "GET /login/?login_only=1&user=ahava&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahava (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.228.165.100
country_id: 6252001
description:
[2025-12-30 22:08:40 +0530] info [cpaneld] 162.228.165.100 - ahav "GET /login/?login_only=1&user=ahav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.126.247
country_id: 6252001
description:
[2025-12-30 22:08:31 +0530] info [cpaneld] 129.222.126.247 - ahavafoundation "GET /login/?login_only=1&user=ahavafoundation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.43.71.191
country_id: 6252001
description:
[2025-12-30 22:08:34 +0530] info [cpaneld] 149.43.71.191 - ahavafoundationlk "GET /login/?login_only=1&user=ahavafoundationlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafoundationlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.68.191
country_id: 6252001
description:
[2025-12-30 22:08:35 +0530] info [cpaneld] 67.209.68.191 - ahavafou "GET /login/?login_only=1&user=ahavafou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.244.188
country_id: 6252001
description:
[2025-12-30 22:08:41 +0530] info [cpaneld] 69.181.244.188 - aha "GET /login/?login_only=1&user=aha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.225.203.227
country_id: 6252001
description:
[2025-12-30 22:08:44 +0530] info [cpaneld] 173.225.203.227 - ahavafo1 "GET /login/?login_only=1&user=ahavafo1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-30 22:11:44 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:53382: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.49
country_id: 3144096
description:
2025-12-30 22:11:54 dovecot_login authenticator failed for H=([84.211.13.49]) [84.211.13.49]:44646: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 22:12:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<h+qtDC5HCrczTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 22:12:24 host2 pure-ftpd[2185374]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 22:13:33 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lhhZDy5HVr4v/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.180.191.252
country_id: 6252001
description:
[2025-12-30 22:14:18 +0530] info [cpaneld] 135.180.191.252 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.79.96.252
country_id: 6252001
description:
[2025-12-30 22:14:22 +0530] info [cpaneld] 173.79.96.252 - lezzarot "GET /login/?login_only=1&user=lezzarot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.118.40
country_id: 6252001
description:
[2025-12-30 22:14:24 +0530] info [cpaneld] 107.216.118.40 - lezzar "GET /login/?login_only=1&user=lezzar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.213.243.74
country_id: 6252001
description:
[2025-12-30 22:14:25 +0530] info [cpaneld] 74.213.243.74 - lezza "GET /login/?login_only=1&user=lezza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.238.82.194
country_id: 6252001
description:
[2025-12-30 22:14:29 +0530] info [cpaneld] 24.238.82.194 - lezzaro1 "GET /login/?login_only=1&user=lezzaro1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.195.4
country_id: 6252001
description:
[2025-12-30 22:14:30 +0530] info [cpaneld] 70.170.195.4 - lezzaro2 "GET /login/?login_only=1&user=lezzaro2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.13.170.221
country_id: 6252001
description:
[2025-12-30 22:14:27 +0530] info [cpaneld] 172.13.170.221 - lez "GET /login/?login_only=1&user=lez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.237.35.92
country_id: 6252001
description:
[2025-12-30 22:14:19 +0530] info [cpaneld] 68.237.35.92 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.29.126
country_id: 6252001
description:
[2025-12-30 22:14:21 +0530] info [whostmgrd] 167.248.29.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.135.102
country_id: 6252001
description:
[2025-12-30 22:14:23 +0530] info [cpaneld] 216.49.135.102 - lezzaro "GET /login/?login_only=1&user=lezzaro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.26.205.236
country_id: 6252001
description:
[2025-12-30 22:14:26 +0530] info [cpaneld] 75.26.205.236 - lezz "GET /login/?login_only=1&user=lezz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.186.163.151
country_id: 6252001
description:
[2025-12-30 22:14:20 +0530] info [cpaneld] 71.186.163.151 - lezzarotech "GET /login/?login_only=1&user=lezzarotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.236.126.115
country_id: 6252001
description:
[2025-12-30 22:14:22 +0530] info [cpaneld] 69.236.126.115 - lezzarotechcom "GET /login/?login_only=1&user=lezzarotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.254.74
country_id: 6252001
description:
[2025-12-30 22:14:28 +0530] info [cpaneld] 73.205.254.74 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.174.29.15
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 192.174.29.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.239.76.43
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 141.239.76.43 - sobaher1 "GET /login/?login_only=1&user=sobaher1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.249.21
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.249.21 - sobah "GET /login/?login_only=1&user=sobah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.132.239.86
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.132.239.86 - sob "GET /login/?login_only=1&user=sob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sob (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.123.15.82
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 163.123.15.82 - sobaherb "GET /login/?login_only=1&user=sobaherb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.220.2.129
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.220.2.129 - sobaher "GET /login/?login_only=1&user=sobaher&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.2.64.24
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.2.64.24 - sobahe "GET /login/?login_only=1&user=sobahe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobahe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.159.209.79
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.159.209.79 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.112.138
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.112.138 - sobaherbal "GET /login/?login_only=1&user=sobaherbal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.62.160
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.170.62.160 - sobaherbalcom "GET /login/?login_only=1&user=sobaherbalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.62.68.17
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.62.68.17 - sobaher2 "GET /login/?login_only=1&user=sobaher2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.175.147.148
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.175.147.148 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.55.205
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.5.55.205 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.18.144.221
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.18.144.221 - asrgrouplk "GET /login/?login_only=1&user=asrgrouplk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrouplk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.200.244.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 151.200.244.16 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.210.130
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.2.210.130 - asrgrou "GET /login/?login_only=1&user=asrgrou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.61.78.33
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.61.78.33 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.90.156.247
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.90.156.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.185.233.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.185.233.122 - asrgroup "GET /login/?login_only=1&user=asrgroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.102.101.181
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.102.101.181 - asrgro "GET /login/?login_only=1&user=asrgro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.16.244.27
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.16.244.27 - asrgr "GET /login/?login_only=1&user=asrgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.0.5
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.0.5 - asrg "GET /login/?login_only=1&user=asrg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.109.67.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.109.67.89 - asr "GET /login/?login_only=1&user=asr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.226.106.167
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.226.106.167 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 22:23:08 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<aJeJMS5HoJZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 22:23:46 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<1bTdMy5H3uIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 22:24:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<SPfWNC5H+NeYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:24:30 host2 sshd[11325]: Disconnected from invalid user test 154.36.158.64 port 48500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 22:24:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Q0E1OC5HQIai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 22:29:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+qhISC5HRJcjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.49.220.61
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.49.220.61 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.63.205.14
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.63.205.14 - age "GET /login/?login_only=1&user=age&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user age (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.164.4
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.170.164.4 - agental1 "GET /login/?login_only=1&user=agental1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.215.161
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.46.215.161 - agentallianzcom "GET /login/?login_only=1&user=agentallianzcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentallianzcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.102.73.112
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.102.73.112 - agen "GET /login/?login_only=1&user=agen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.8.83
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.8.83 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.45.97.129
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.45.97.129 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.172.192.235
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.172.192.235 - agentallianz "GET /login/?login_only=1&user=agentallianz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User agentallianz has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.125.184.74
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.125.184.74 - agenta "GET /login/?login_only=1&user=agenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.252.221.6
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.252.221.6 - agent "GET /login/?login_only=1&user=agent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.47.35.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 156.47.35.141 - agental2 "GET /login/?login_only=1&user=agental2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:30:11 host2 sshd[13981]: Disconnected from invalid user admin 154.36.158.64 port 57342 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.226.112.102
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 66.226.112.102 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.184.33.124
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.184.33.124 - agentall "GET /login/?login_only=1&user=agentall&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentall (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.63.175.86
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.63.175.86 - agental "GET /login/?login_only=1&user=agental&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:31:34 host2 sshd[15129]: Disconnected from invalid user ali 154.36.158.64 port 56410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-30 22:32:08 dovecot_plain authenticator failed for H=(gurersess) [12.150.243.22]:54890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 22:34:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<b5uRWC5HOotn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 22:34:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<pNK8WC5HaIpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 22:34:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<L5I+Wi5H1LUv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:35:27 host2 sshd[18577]: Disconnected from invalid user ubuntu 154.36.158.64 port 49426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:36:08 host2 sshd[19107]: Disconnected from invalid user postgres 154.36.158.64 port 41972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 22:38:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<pjMlZy5HSpqeRdGr>


