# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.16.183.103
country_id: 6252001
description:
[2025-12-31 10:36:41 +0530] info [whostmgrd] 216.16.183.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.161.6.253
country_id: 6252001
description:
[2025-12-31 10:36:40 +0530] info [cpaneld] 67.161.6.253 - agronatureholdings "GET /login/?login_only=1&user=agronatureholdings&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatureholdings (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.194.51
country_id: 6252001
description:
[2025-12-31 10:36:48 +0530] info [cpaneld] 184.179.194.51 - agron "GET /login/?login_only=1&user=agron&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agron (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.139.42.193
country_id: 6252001
description:
[2025-12-31 10:36:44 +0530] info [cpaneld] 107.139.42.193 - agronatu "GET /login/?login_only=1&user=agronatu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.237.100.144
country_id: 6252001
description:
[2025-12-31 10:36:51 +0530] info [cpaneld] 104.237.100.144 - agr "GET /login/?login_only=1&user=agr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.113.235.43
country_id: 6252001
description:
[2025-12-31 10:36:52 +0530] info [cpaneld] 146.113.235.43 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.166.167
country_id: 6252001
description:
[2025-12-31 10:36:56 +0530] info [cpaneld] 172.58.166.167 - agronat1 "GET /login/?login_only=1&user=agronat1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronat1 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:37:25 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<GbS/czhHorMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:39:05 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<txqueThHsKkDgmBb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.129.15.80
country_id: 6252001
description:
[2025-12-31 10:39:28 +0530] info [cpaneld] 68.129.15.80 - kiriasw "GET /login/?login_only=1&user=kiriasw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriasw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.59.204
country_id: 6252001
description:
[2025-12-31 10:39:31 +0530] info [cpaneld] 184.164.59.204 - kiri "GET /login/?login_only=1&user=kiri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.31.23.6
country_id: 6252001
description:
[2025-12-31 10:39:36 +0530] info [cpaneld] 71.31.23.6 - kiriasw1 "GET /login/?login_only=1&user=kiriasw1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriasw1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.240.250.2
country_id: 6252001
description:
[2025-12-31 10:39:25 +0530] info [whostmgrd] 70.240.250.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 10:39:31 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<GpkXezhHLuoFhXlo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.238.255.81
country_id: 6252001
description:
[2025-12-31 10:39:22 +0530] info [cpaneld] 70.238.255.81 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.137.4
country_id: 6252001
description:
[2025-12-31 10:39:23 +0530] info [cpaneld] 172.59.137.4 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.97.249.244
country_id: 6252001
description:
[2025-12-31 10:39:24 +0530] info [cpaneld] 68.97.249.244 - kiriaswanu "GET /login/?login_only=1&user=kiriaswanu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriaswanu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.233.5.138
country_id: 6252001
description:
[2025-12-31 10:39:29 +0530] info [cpaneld] 152.233.5.138 - kirias "GET /login/?login_only=1&user=kirias&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kirias (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.36.58
country_id: 6252001
description:
[2025-12-31 10:39:33 +0530] info [cpaneld] 73.92.36.58 - ki "GET /login/?login_only=1&user=ki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.36.82.219
country_id: 6252001
description:
[2025-12-31 10:39:37 +0530] info [cpaneld] 108.36.82.219 - kiriasw2 "GET /login/?login_only=1&user=kiriasw2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriasw2 (has_cpuser_file failed)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:39:39 host2 dovecot[779926]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<RfKyezhHcswDgmBb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.55.183.225
country_id: 6252001
description:
[2025-12-31 10:39:26 +0530] info [cpaneld] 98.55.183.225 - kiriaswanucom "GET /login/?login_only=1&user=kiriaswanucom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiriaswanucom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.98.204.81
country_id: 6252001
description:
[2025-12-31 10:39:27 +0530] info [cpaneld] 64.98.204.81 - kiriaswa "GET /login/?login_only=1&user=kiriaswa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.84.141.203
country_id: 6252001
description:
[2025-12-31 10:39:30 +0530] info [cpaneld] 67.84.141.203 - kiria "GET /login/?login_only=1&user=kiria&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kiria (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.75.211.157
country_id: 6252001
description:
[2025-12-31 10:39:32 +0530] info [cpaneld] 149.75.211.157 - kir "GET /login/?login_only=1&user=kir&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kir (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 10:40:08 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<postfix@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<DCo2fThHWJOeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:40:35 host2 dovecot[779926]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=</2ALfzhHYIYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:42:06 host2 dovecot[779926]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<AZRxhDhHAIcDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 31 10:42:19 host2 sshd[841984]: Disconnected from invalid user user 2.57.121.25 port 18654 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 10:42:51 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Qy0DhzhHJuxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.150
country_id: 3469034
description:
Dec 31 10:43:17 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=190.89.137.150, lip=66.85.158.91, TLS, session=<w9R/hzhHUeS+WYmW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.60
country_id: 6252001
description:
Dec 31 10:43:28 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.60, lip=66.85.158.91, session=<j59diThHlJsUQcM8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.228
country_id: 3469034
description:
Dec 31 10:43:37 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=187.120.73.228, lip=66.85.158.91, TLS, session=<uAHOiDhH5dK7eEnk>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 10:44:01 host2 pure-ftpd[844022]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 10:44:52 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<KCo+jjhHqLgv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 10:46:00 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=</BZNkjhHDM+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 10:54:06 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<YkI/rzhHvO5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 10:56:15 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<RHX2tjhHwMGeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.203
country_id: 1269750
description:
Dec 31 10:56:35 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=103.164.246.203, lip=66.85.158.91, TLS, session=<AiQptzhHieJnpPbL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.33
country_id: 3469034
description:
Dec 31 10:56:56 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.44.71.33, lip=66.85.158.91, TLS, session=<ymhhuDhHfL+xLEch>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.109
country_id: 1819730
description:
Dec 31 11:01:10 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=45.142.154.109, lip=66.85.158.92, TLS, session=<+FOvyDhHisMtjppt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 11:01:28 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fm2WyThHbNBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 11:01:34 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mjX9yThHhpqi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 31 11:01:39 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<1+ZkyjhHrtoDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-31 11:02:47 dovecot_login authenticator failed for H=([182.163.122.133]) [182.163.122.133]:7701: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.87
country_id: 1210997
description:
2025-12-31 11:03:06 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.87]:44548: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 11:04:46 host2 sshd[870266]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 31 11:06:03 host2 dovecot[779926]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<69kj2jhH4v8t4/6Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.115.147.5
country_id: 3923057
description:
Dec 31 11:05:33 host2 sshd[871523]: Disconnected from invalid user dylan 181.115.147.5 port 58476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 11:05:36 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Yade2DhHWNWYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 31 11:07:15 host2 sshd[873750]: Disconnected from invalid user vsftpd 107.174.67.215 port 53544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.115.147.5
country_id: 3923057
description:
Dec 31 11:07:59 host2 sshd[874657]: Disconnected from invalid user ts3 181.115.147.5 port 37220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.115.147.5
country_id: 3923057
description:
Dec 31 11:09:19 host2 sshd[876082]: Disconnected from invalid user znc-admin 181.115.147.5 port 33046 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.65.254.39
country_id: 3017382
description:
Dec 31 11:11:08 host2 sshd[878280]: Disconnected from invalid user gast 82.65.254.39 port 35394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 31 11:11:09 host2 sshd[878306]: Disconnected from invalid user ts3 107.174.67.215 port 46830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 31 11:12:13 host2 sshd[879602]: Disconnected from invalid user up 107.174.67.215 port 42538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 11:15:45 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<v0Ks/DhHBth100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 11:16:57 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<NXH3ADlH+K8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 11:18:25 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SUgzBjlHEG0jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 11:21:48 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<zzdaEjlHmLEyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 11:22:33 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<tgz/FDlHaqtCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 11:27:45 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<C7qfJzlHdo2eRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.153.209.155
country_id: 6252001
description:
[2025-12-31 11:29:42 +0530] info [cpaneld] 23.153.209.155 - colourmarklabelscom "GET /login/?login_only=1&user=colourmarklabelscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabelscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.186.22.238
country_id: 6252001
description:
[2025-12-31 11:29:47 +0530] info [cpaneld] 64.186.22.238 - colou "GET /login/?login_only=1&user=colou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.172.203.181
country_id: 6252001
description:
[2025-12-31 11:29:58 +0530] info [cpaneld] 207.172.203.181 - colourm2 "GET /login/?login_only=1&user=colourm2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.232.72.100
country_id: 6252001
description:
[2025-12-31 11:29:37 +0530] info [cpaneld] 76.232.72.100 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.199.75.97
country_id: 6252001
description:
[2025-12-31 11:29:40 +0530] info [cpaneld] 72.199.75.97 - colourmarklabels "GET /login/?login_only=1&user=colourmarklabels&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.205.106.198
country_id: 6252001
description:
[2025-12-31 11:29:57 +0530] info [cpaneld] 162.205.106.198 - colourm1 "GET /login/?login_only=1&user=colourm1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.220.229.111
country_id: 6252001
description:
[2025-12-31 11:29:45 +0530] info [cpaneld] 108.220.229.111 - colour "GET /login/?login_only=1&user=colour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colour (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.54.92.158
country_id: 6252001
description:
[2025-12-31 11:29:53 +0530] info [cpaneld] 108.54.92.158 - col "GET /login/?login_only=1&user=col&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user col (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.14.122
country_id: 6252001
description:
[2025-12-31 11:29:38 +0530] info [cpaneld] 98.97.14.122 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.9.237.94
country_id: 6252001
description:
[2025-12-31 11:29:41 +0530] info [whostmgrd] 68.9.237.94 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.185.122.172
country_id: 6252001
description:
[2025-12-31 11:29:43 +0530] info [cpaneld] 173.185.122.172 - colourm "GET /login/?login_only=1&user=colourm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.212.6
country_id: 6252001
description:
[2025-12-31 11:29:52 +0530] info [cpaneld] 97.170.212.6 - colo "GET /login/?login_only=1&user=colo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.172.169.190
country_id: 6252001
description:
[2025-12-31 11:29:56 +0530] info [cpaneld] 67.172.169.190 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.67.163.118
country_id: 6252001
description:
[2025-12-31 11:29:43 +0530] info [cpaneld] 73.67.163.118 - colourma "GET /login/?login_only=1&user=colourma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourma (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-31 11:31:44 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:36225: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.168.173
country_id: 298795
description:
2025-12-31 11:31:58 dovecot_login authenticator failed for H=([5.11.168.173]) [5.11.168.173]:41862: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 11:32:03 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Ck73NjlH+twv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 11:33:14 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<koc4OzlH0qGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 11:33:27 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<wZn5OzlHHRtniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-12-31 11:34:01 dovecot_login authenticator failed for H=(nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:51799: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 11:34:30 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0FfEPzlHDsgjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.244
country_id: 6252001
description:
Dec 31 11:35:24 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.244, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<bWwQQzlHXd7N0h/0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 11:38:01 host2 sshd[909750]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 11:39:35 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<3/rxUTlHPMEzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.78
country_id: 6252001
description:
Dec 31 11:40:02 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.78, lip=66.85.158.92, TLS, session=<eDmiUzlH4PGTuYRO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 11:43:15 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<R1H3XjlHirRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 11:44:31 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<8dCVYzlHAuUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 11:46:33 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<T0HXajlHWrieRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 11:47:09 host2 pure-ftpd[921287]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-12-31 11:48:58 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:36714: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.255.248
country_id: 2921044
description:
Dec 31 11:48:28 host2 pure-ftpd[923197]: (?@46.101.255.248) [INFO] New connection from 46.101.255.248


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-12-31 11:48:33 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:36032: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 46.101.255.248
country_id: 2921044
description:
Dec 31 11:48:39 host2 pure-ftpd[923485]: (?@46.101.255.248) [INFO] New connection from 46.101.255.248


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 11:53:51 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<F7/thDlHCNgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 11:55:45 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<fYC8izlHos8v/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.33
country_id: 1819730
description:
Dec 31 11:56:14 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.33, lip=66.85.158.91, TLS, session=<LuSZjTlHVpktjpoh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 31 11:58:04 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<h68ilDlHvrZChJly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 11:58:06 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<oKAplDlH9Myi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 31 11:58:36 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS handshaking: Connection closed, session=<i1MLljlHUKZChJlw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.197
country_id: 6252001
description:
Dec 31 11:59:28 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.197, lip=66.85.158.91, TLS, session=<K5ommTlHBvHN0h/F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-12-31 12:01:13 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:48310: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 12:01:18 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<byGWnzlHIgpo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-31 12:01:30 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:33532: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 12:02:01 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<d+EpojlHWoZnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Dec 31 12:05:35 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS: Connection closed, session=<wVUGrzlHCH9ChJmG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-31 12:07:16 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (jureve) [73.137.7.97]:47782: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.238.167.244
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 104.238.167.244: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 12:11:15 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hiwnwzlHMD9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 12:16:31 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<eUgB1jlHSr6eRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-31 12:17:37 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:36720: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2025-12-31 12:18:04 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:42466: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Dec 31 12:19:06 host2 sshd[961671]: Disconnected from invalid user testing 122.165.121.195 port 39106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 31 12:19:36 host2 sshd[962284]: Disconnected from invalid user rstudio 125.21.53.232 port 55942 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 12:20:21 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Ls274zlHTmgjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Dec 31 12:21:43 host2 sshd[964976]: Disconnected from invalid user ubuntu 122.165.121.195 port 40410 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 31 12:22:11 host2 sshd[965610]: Disconnected from invalid user demo 189.112.0.11 port 50288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 31 12:21:28 host2 sshd[964732]: Disconnected from invalid user elaine 189.112.0.11 port 38462 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 31 12:21:31 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, session=<uqL/5zlHh//CpRCm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.57
country_id: 1880251
description:
Dec 31 12:22:34 host2 sshd[966048]: Disconnected from invalid user openstack 165.154.29.57 port 58164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 31 12:22:53 host2 sshd[966543]: Disconnected from invalid user jack 189.112.0.11 port 33878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 31 12:23:09 host2 sshd[966859]: Disconnected from invalid user move 125.21.53.232 port 38278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Dec 31 12:23:34 host2 sshd[967344]: Disconnected from invalid user marta 189.112.0.11 port 45702 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.29.57
country_id: 1880251
description:
Dec 31 12:23:56 host2 sshd[967801]: Disconnected from invalid user hyperic 165.154.29.57 port 51584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 31 12:24:26 host2 sshd[968363]: Disconnected from invalid user ark 125.21.53.232 port 36370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.57
country_id: 1880251
description:
Dec 31 12:24:37 host2 sshd[968529]: Disconnected from invalid user storm 165.154.29.57 port 59332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Dec 31 12:25:16 host2 sshd[969383]: Disconnected from invalid user develop 122.165.121.195 port 37728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 12:28:06 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<jW1q/zlHzNieRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Dec 31 12:28:38 host2 sshd[973560]: Disconnected from invalid user lighthouse 122.165.121.195 port 59456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-31 12:29:22 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:42854: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-31 12:29:38 dovecot_login authenticator failed for H=([178.232.220.147]) [178.232.220.147]:51325: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 12:30:05 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Dzd9BjpHjuhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 12:31:02 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Ly7xCTpH00Zniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 12:32:43 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<wa3zDzpH9NWeRdGr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Dec 31 12:34:50 host2 sshd[980979]: Disconnected from invalid user user5 122.165.121.195 port 58806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-31 12:35:58 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (haddly) [87.103.126.54]:44701: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 12:36:10 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<rHJLHDpHDtGYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 12:36:39 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+bf+HTpHEnEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 12:36:39 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<oREEHjpHjvai8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.111
country_id: 2186224
description:
2025-12-31 12:36:14 dovecot_login authenticator failed for H=([121.73.169.111]) [121.73.169.111]:37070: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 31 12:37:58 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, TLS, session=<+YbVIjpHeMcD7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 31 12:38:12 host2 sshd[985399]: Disconnected from invalid user ubuntu 123.58.213.126 port 51368 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.222
country_id: 6252001
description:
Dec 31 12:39:08 host2 dovecot[779926]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.222, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<E48DJzpHjMnG6xje>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.84.166.232
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 162.84.166.232 - lankah "GET /login/?login_only=1&user=lankah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.171.143.52
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 165.171.143.52 - lank "GET /login/?login_only=1&user=lank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.191.41.235
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.191.41.235 - lanka "GET /login/?login_only=1&user=lanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lanka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.173.234.135
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.173.234.135 - lankaher "GET /login/?login_only=1&user=lankaher&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.167.206.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.167.206.11 - lankaherbalsolutionscom "GET /login/?login_only=1&user=lankaherbalsolutionscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolutionscom (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.235.136
country_id: 102358
description:
Dec 31 12:39:55 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.235.136, lip=66.85.158.91, session=<kRDSKTpHUoJfteuI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.173.62
country_id: 2921044
description:
Dec 31 12:39:58 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.173.62, lip=66.85.158.91, TLS handshaking: Connection closed, session=<t4b6KTpHmsm11q0+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 77.81.142.147
country_id: 3996063
description:
Dec 31 12:39:58 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=77.81.142.147, lip=66.85.158.91, TLS, session=<BX76KTpHhNtNUY6T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 12:39:25 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<OYbiJzpHOr0vWBNS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.57.16.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.57.16.55 - lankahe "GET /login/?login_only=1&user=lankahe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.111.128.212
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.111.128.212 - lankahe2 "GET /login/?login_only=1&user=lankahe2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.4.97.253
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.4.97.253 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.40
country_id: 1831722
description:
Dec 31 12:39:55 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.40, lip=66.85.158.91, session=<m/HQKTpH0Iu81+so>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.132.207
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.5.132.207 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.123.230.144
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 165.123.230.144 - lan "GET /login/?login_only=1&user=lan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.120.191.225
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.120.191.225 - lankahe1 "GET /login/?login_only=1&user=lankahe1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe1 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.27
country_id: 3439705
description:
Dec 31 12:39:55 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.84.102.27, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+BbMKTpHSpotVGYb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.112.17
country_id: 1210997
description:
Dec 31 12:39:55 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=64.64.112.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WEXQKTpHRsZAQHAR>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.251.14.196
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.251.14.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.230.31
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 73.41.230.31 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.10.188
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.10.188 - lankaherbalsolutions "GET /login/?login_only=1&user=lankaherbalsolutions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolutions (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 12:40:41 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<fRN3LDpHjI8yBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.49.29
country_id: 1668284
description:
Dec 31 12:41:09 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.49.29, lip=66.85.158.91, session=<uiE3LjpHGIut9DEd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.153.36
country_id: 6251999
description:
Dec 31 12:41:09 host2 dovecot[988630]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=181.214.153.36, lip=66.85.158.91, session=<dh8zLjpHPNq11pkk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.17.108.247
country_id: 6290252
description:
Dec 31 12:41:11 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=217.17.108.247, lip=66.85.158.91, TLS, session=<tSBeLTpH9K3ZEWz3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.110
country_id: 226074
description:
Dec 31 12:41:32 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.107.110, lip=66.85.158.91, TLS, session=<6/B8LjpHepvEAGtu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.101.210.57
country_id: 2077456
description:
Dec 31 12:41:19 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=191.101.210.57, lip=66.85.158.91, session=<0bjYLjpHfOe/ZdI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.235.136
country_id: 102358
description:
Dec 31 12:41:19 host2 dovecot[988630]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=95.181.235.136, lip=66.85.158.91, session=<NEvSLjpHiudfteuI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.237
country_id: 1269750
description:
Dec 31 12:43:06 host2 sshd[991551]: Disconnected from invalid user user 117.252.16.237 port 51510 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 12:43:46 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<bzdyNzpHAp5n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 12:44:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eNp8ODpHiLEv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.252.16.237
country_id: 1269750
description:
Dec 31 12:44:29 host2 sshd[993271]: Disconnected from invalid user ftpuser 117.252.16.237 port 44468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 12:47:11 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<bI60QzpHKL2eRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.60.16.26
country_id: 3996063
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 190.60.16.26 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 31 12:48:47 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS: Connection closed, session=<ypuDSTpHyNtChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.237
country_id: 1269750
description:
Dec 31 12:49:14 host2 sshd[999046]: Disconnected from invalid user admin 117.252.16.237 port 48006 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 12:50:16 host2 pure-ftpd[1000408]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 12:51:32 host2 sshd[1001864]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 12:52:01 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<lZL8VDpHZNczTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-31 12:57:12 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:49346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 12:56:18 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<5LVOZDpHurGi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 12:57:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Njn1ZjpHYIEzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2025-12-31 12:57:25 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:57313: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-31 12:57:36 dovecot_login authenticator failed for H=([122.184.127.86]) [122.184.127.86]:49348: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-31 12:57:59 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:44552: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.4
country_id: 6252001
description:
Dec 31 12:58:07 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.4, lip=66.85.158.92, session=<q0XhajpHaJjCpGsE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-31 12:59:12 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:53487: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.128.128.212
country_id: 2077456
description:
2025-12-31 12:59:25 dovecot_login authenticator failed for H=(115-128-128-212.tpgi.com.au) [115.128.128.212]:59744: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 31 12:59:47 host2 sshd[1012194]: Disconnected from invalid user server 123.58.213.126 port 38506 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 13:01:50 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<AeASeDpHJqFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 13:04:52 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<6tftgjpHquB100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.159
country_id: 6252001
description:
Dec 31 13:04:53 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.159, lip=66.85.158.91, TLS, session=<zUYdgzpHhPmTuYSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 13:07:51 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<M6SQjTpH+KkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 13:08:15 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<a6AHjzpHqN4v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 13:09:10 host2 sshd[1024119]: Disconnected from invalid user admin 2.57.121.112 port 64856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 13:09:53 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<gUPhlDpHOp9o7MS0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.254.141.82
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.254.141.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.206.185.71
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.206.185.71 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.106.254.14
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.106.254.14 - col "GET /login/?login_only=1&user=col&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user col (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.167.152.212
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.167.152.212 - colperlab "GET /login/?login_only=1&user=colperlab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.47.244.43
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.47.244.43 - colperlabcom "GET /login/?login_only=1&user=colperlabcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colperlabcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.222.65.144
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.222.65.144 - colpe "GET /login/?login_only=1&user=colpe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colpe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.47.80.103
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 156.47.80.103 - colp "GET /login/?login_only=1&user=colp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.28.148.121
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 108.28.148.121 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.120.212
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.203.120.212 - colperla "GET /login/?login_only=1&user=colperla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colperla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.11.122.128
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.11.122.128 - colper "GET /login/?login_only=1&user=colper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.167.134.75
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.167.134.75 - colperl "GET /login/?login_only=1&user=colperl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colperl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.140.15.159
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.140.15.159 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-31 13:20:02 dovecot_plain authenticator failed for H=(huckers) [24.187.213.29]:49594: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 13:22:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<YdiDwzpHDocjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 13:24:47 host2 sshd[1043827]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.99
country_id: 6252001
description:
Dec 31 13:25:31 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.99, lip=66.85.158.92, TLS, session=<pwTnzDpHWPbG6xhj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.78
country_id: 2542007
description:
2025-12-31 13:27:08 dovecot_login authenticator failed for H=([105.73.190.78]) [105.73.190.78]:48906: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.91.135
country_id: 2077456
description:
2025-12-31 13:26:42 dovecot_login authenticator failed for H=([123.209.91.135]) [123.209.91.135]:56622: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-31 13:27:22 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:42119: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 13:28:57 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YAEH2TpHRSVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 13:29:27 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rIrY2jpH6N+eRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.220.48
country_id: 2921044
description:
Dec 31 13:29:46 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=209.38.220.48, lip=66.85.158.91, TLS, session=<ZrQU3DpHAiPRJtww>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.61.159.178
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.61.159.178 - ceylonparampara "GET /login/?login_only=1&user=ceylonparampara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylonparampara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.223.39.39
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.223.39.39 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.9.170.224
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.9.170.224 - ceylonp2 "GET /login/?login_only=1&user=ceylonp2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylonp2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.67.6.109
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 64.67.6.109 - ceylonpa "GET /login/?login_only=1&user=ceylonpa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.174.196.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.174.196.114 - ceylon "GET /login/?login_only=1&user=ceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.108.129.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.108.129.55 - ceylo "GET /login/?login_only=1&user=ceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.101.237.194
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.101.237.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.19.82.195
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 100.19.82.195 - ceylonparamparalk "GET /login/?login_only=1&user=ceylonparamparalk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylonparamparalk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.53.3.215
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.53.3.215 - ceylonp "GET /login/?login_only=1&user=ceylonp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylonp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.27.237.21
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.27.237.21 - cey "GET /login/?login_only=1&user=cey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.116.46.168
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.116.46.168 - ceylonp1 "GET /login/?login_only=1&user=ceylonp1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylonp1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.195.101.200
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.195.101.200 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.168.234
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.59.168.234 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.184.121.15
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.184.121.15 - ceyl "GET /login/?login_only=1&user=ceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.54
country_id: 6252001
description:
Dec 31 13:35:53 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.54, lip=66.85.158.91, session=<cWD68TpH7PqTuYQ2>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.112.203.109
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.112.203.109 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.217.92.245
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.217.92.245 - systemte "GET /login/?login_only=1&user=systemte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.124.122.225
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.124.122.225 - syst "GET /login/?login_only=1&user=syst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user syst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.182.59.125
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 184.182.59.125 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.153.21.101
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.153.21.101 - syste "GET /login/?login_only=1&user=syste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user syste (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 13:37:04 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Y+IY9jpHRM5CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 31 13:37:06 host2 dovecot[988630]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, session=<WJtN9jpHmrk2rEyT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.126.210.74
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.126.210.74 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.35.1.4
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.35.1.4 - systemtec "GET /login/?login_only=1&user=systemtec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemtec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.84.124.200
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.84.124.200 - system "GET /login/?login_only=1&user=system&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user system (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.76.32
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 129.222.76.32 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.71.205.158
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 206.71.205.158 - systemteclk "GET /login/?login_only=1&user=systemteclk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemteclk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.41.21.33
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.41.21.33 - systemt "GET /login/?login_only=1&user=systemt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user systemt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.9.168.136
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.9.168.136 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.12.94.119
country_id: 6252001
description:
[2025-12-31 13:38:28 +0530] info [cpaneld] 146.12.94.119 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.172.62.90
country_id: 6252001
description:
[2025-12-31 13:38:27 +0530] info [cpaneld] 71.172.62.90 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-31 13:38:43 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (morhian) [98.204.134.124]:45712: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.98.92
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 12.74.98.92 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.131.31.220
country_id: 6252001
description:
[2025-12-31 13:38:26 +0530] info [whostmgrd] 157.131.31.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.1.228
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 129.222.1.228 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.34.231.47
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.34.231.47 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.208.9
country_id: 6252001
description:
[2025-12-31 13:38:29 +0530] info [cpaneld] 99.66.208.9 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 13:39:27 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ArmT/jpH/FMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 13:40:13 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<xm5bATtHavCi8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.220.48
country_id: 2921044
description:
Dec 31 13:41:05 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=209.38.220.48, lip=66.85.158.91, TLS, session=<34GRBDtHem/RJtww>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.220.48
country_id: 2921044
description:
Dec 31 13:41:16 host2 dovecot[988630]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=209.38.220.48, lip=66.85.158.91, session=<EaUzBTtHcGbRJtww>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 13:44:25 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<l2hZEDtH3M1n9M4G>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.171.8
country_id: 1694008
description:
[2025-12-31 13:45:04 +0530] info [cpaneld] 103.60.171.8 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.171.8
country_id: 1694008
description:
[2025-12-31 13:46:55 +0530] info [cpaneld] 103.60.171.8 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 13:48:41 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rxGaHztH8rueRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.239.247
country_id: 6252001
description:
[2025-12-31 13:48:25 +0530] info [cpaneld] 67.187.239.247 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.116.124.10
country_id: 6252001
description:
[2025-12-31 13:48:28 +0530] info [whostmgrd] 98.116.124.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.22.46
country_id: 6252001
description:
[2025-12-31 13:48:29 +0530] info [cpaneld] 38.43.22.46 - ksoftlk "GET /login/?login_only=1&user=ksoftlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoftlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.14.178
country_id: 6252001
description:
[2025-12-31 13:48:33 +0530] info [cpaneld] 172.56.14.178 - ks "GET /login/?login_only=1&user=ks&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ks (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.247.176.204
country_id: 6252001
description:
[2025-12-31 13:48:31 +0530] info [cpaneld] 76.247.176.204 - kso "GET /login/?login_only=1&user=kso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kso (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 13:48:53 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57228: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.176.105.205
country_id: 6252001
description:
[2025-12-31 13:48:27 +0530] info [cpaneld] 184.176.105.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.30.126.186
country_id: 6252001
description:
[2025-12-31 13:48:28 +0530] info [cpaneld] 66.30.126.186 - ksoft "GET /login/?login_only=1&user=ksoft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.43.84.240
country_id: 6252001
description:
[2025-12-31 13:48:30 +0530] info [cpaneld] 99.43.84.240 - ksof "GET /login/?login_only=1&user=ksof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.208.161.146
country_id: 6252001
description:
[2025-12-31 13:50:06 +0530] info [cpaneld] 72.208.161.146 - trail "GET /login/?login_only=1&user=trail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.67.198.5
country_id: 6252001
description:
[2025-12-31 13:50:08 +0530] info [cpaneld] 64.67.198.5 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.244.137.130
country_id: 6252001
description:
[2025-12-31 13:50:09 +0530] info [cpaneld] 96.244.137.130 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.166.102
country_id: 6252001
description:
[2025-12-31 13:49:58 +0530] info [cpaneld] 172.58.166.102 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.47.219.20
country_id: 6252001
description:
[2025-12-31 13:50:01 +0530] info [whostmgrd] 75.47.219.20 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.161.135.198
country_id: 6252001
description:
[2025-12-31 13:50:04 +0530] info [cpaneld] 99.161.135.198 - trailslk "GET /login/?login_only=1&user=trailslk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trailslk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.239.72.28
country_id: 6252001
description:
[2025-12-31 13:50:00 +0530] info [cpaneld] 24.239.72.28 - trails "GET /login/?login_only=1&user=trails&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.90.239.108
country_id: 6252001
description:
[2025-12-31 13:50:00 +0530] info [cpaneld] 75.90.239.108 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.143.162.110
country_id: 6252001
description:
[2025-12-31 13:50:07 +0530] info [cpaneld] 73.143.162.110 - trai "GET /login/?login_only=1&user=trai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trai (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 13:53:28 host2 pure-ftpd[1079867]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 13:54:08 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<UbISMztHSMmeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 13:54:59 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<G4UnNjtHqOKi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-12-31 13:56:37 dovecot_login authenticator failed for H=(c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:50955: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-12-31 13:56:54 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:45451: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 13:56:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<s/UOPTtHGtAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 13:58:35 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<pW4KQztHCOF100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 13:59:53 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<n5KpRztHxOgyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-12-31 14:00:23 dovecot_login authenticator failed for H=([196.216.220.210]) [196.216.220.210]:56042: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-12-31 14:00:41 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:50552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-31 14:01:01 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:46363: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.63
country_id: 2186224
description:
2025-12-31 14:01:18 dovecot_login authenticator failed for H=([121.73.169.63]) [121.73.169.63]:35280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 14:01:53 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<w4fQTjtHjutnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 14:02:32 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pdUoUTtHTMsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 14:04:57 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QR3UWTtHNJUzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.178
country_id: 6252001
description:
Dec 31 14:05:01 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.178, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2ssgWjtHB9xAPsWy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.139.75.232
country_id: 6252001
description:
[2025-12-31 14:04:50 +0530] info [cpaneld] 3.139.75.232 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 31 14:06:09 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<t64PXjtHtOVV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-31 14:06:12 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:36090: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.167
country_id: 6252001
description:
Dec 31 14:05:18 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.167, lip=66.85.158.91, TLS handshaking: Connection closed, session=<HB0xWztHmFVAPsWn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2025-12-31 14:05:53 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:44915: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.160.205.53
country_id: 6252001
description:
[2025-12-31 14:06:56 +0530] info [cpaneld] 98.160.205.53 - sivagn "GET /login/?login_only=1&user=sivagn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.9.234.8
country_id: 6252001
description:
[2025-12-31 14:06:57 +0530] info [cpaneld] 38.9.234.8 - sivag "GET /login/?login_only=1&user=sivag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivag (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 14:07:05 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<l6ZxYTtH5qyYNcU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.150.205.27
country_id: 6252001
description:
[2025-12-31 14:06:55 +0530] info [cpaneld] 99.150.205.27 - sivagna "GET /login/?login_only=1&user=sivagna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.34.9
country_id: 6252001
description:
[2025-12-31 14:06:59 +0530] info [cpaneld] 172.56.34.9 - siv "GET /login/?login_only=1&user=siv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user siv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.24.104.153
country_id: 6252001
description:
[2025-12-31 14:07:01 +0530] info [cpaneld] 75.24.104.153 - sivagna1 "GET /login/?login_only=1&user=sivagna1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagna1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.33.147.27
country_id: 6252001
description:
[2025-12-31 14:07:00 +0530] info [cpaneld] 64.33.147.27 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.38.112
country_id: 6252001
description:
[2025-12-31 14:07:02 +0530] info [cpaneld] 73.92.38.112 - sivagna2 "GET /login/?login_only=1&user=sivagna2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagna2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.22
country_id: 6252001
description:
[2025-12-31 14:06:49 +0530] info [cpaneld] 172.58.212.22 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.194.178.57
country_id: 6252001
description:
[2025-12-31 14:06:48 +0530] info [cpaneld] 68.194.178.57 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.244.237.187
country_id: 6252001
description:
[2025-12-31 14:06:51 +0530] info [whostmgrd] 71.244.237.187 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.97.108.56
country_id: 6252001
description:
[2025-12-31 14:06:50 +0530] info [cpaneld] 99.97.108.56 - sivagnanamfoundation "GET /login/?login_only=1&user=sivagnanamfoundation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.249.193.139
country_id: 6252001
description:
[2025-12-31 14:06:52 +0530] info [cpaneld] 98.249.193.139 - sivagnanamfoundationcom "GET /login/?login_only=1&user=sivagnanamfoundationcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnanamfoundationcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.245.200.50
country_id: 6252001
description:
[2025-12-31 14:06:54 +0530] info [cpaneld] 24.245.200.50 - sivagnan "GET /login/?login_only=1&user=sivagnan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sivagnan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.158.72
country_id: 6252001
description:
[2025-12-31 14:06:58 +0530] info [cpaneld] 24.4.158.72 - siva "GET /login/?login_only=1&user=siva&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user siva (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.171.8
country_id: 1694008
description:
[2025-12-31 14:09:04 +0530] info [cpaneld] 103.60.171.8 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 14:09:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<nnKlaztH+OozTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 14:10:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<3ytlbTtH6oyeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 14:16:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<SDCYhDtHwoJo7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec 31 14:17:32 host2 dovecot[988630]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, session=<c5DlhjtHhIY2xDDo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 14:20:59 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<DisXkztHkI4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 14:23:15 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<+vY0mztHWssFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-12-31 14:24:16 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:41588: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 14:25:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JTjCpDtHtrcjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.171.8
country_id: 1694008
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 103.60.171.8 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 14:26:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HTdXqDtHfjJniu0S>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.23.238
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 67.209.23.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.2.154.22
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.2.154.22 - sunriselanka "GET /login/?login_only=1&user=sunriselanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.244.188
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.181.244.188 - sunriselankalk "GET /login/?login_only=1&user=sunriselankalk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunriselankalk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.84.24.120
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.84.24.120 - sunrisel "GET /login/?login_only=1&user=sunrisel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrisel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.88.9.181
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 208.88.9.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.23.248.118
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.23.248.118 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.73.80.20
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.73.80.20 - sunrise "GET /login/?login_only=1&user=sunrise&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrise (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.6.21.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.6.21.89 - sunris "GET /login/?login_only=1&user=sunris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunris (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.130.113.169
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.130.113.169 - sunrise2 "GET /login/?login_only=1&user=sunrise2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrise2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.169.216
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.169.216 - su "GET /login/?login_only=1&user=su&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user su (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 14:30:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Ux2stjtHjOGeRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.188.32.123
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.188.32.123 - sunri "GET /login/?login_only=1&user=sunri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.86.82
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.86.82 - sun "GET /login/?login_only=1&user=sun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.226.82.187
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.226.82.187 - sunr "GET /login/?login_only=1&user=sunr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.139.51.95
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.139.51.95 - sunrise1 "GET /login/?login_only=1&user=sunrise1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sunrise1 (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 14:38:20 host2 sshd[1134974]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.39.217
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.31.39.217 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.21.23.214
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.21.23.214 - visionsolutionshospital "GET /login/?login_only=1&user=visionsolutionshospital&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospital (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.224.200.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.224.200.11 - visions1 "GET /login/?login_only=1&user=visions1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.196.204.222
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.196.204.222 - vision "GET /login/?login_only=1&user=vision&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vision (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.24.207
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.24.207 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.212.26.4
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 207.212.26.4 - visions2 "GET /login/?login_only=1&user=visions2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.92.160.3
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.92.160.3 - visio "GET /login/?login_only=1&user=visio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.171.137.98
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.171.137.98 - visi "GET /login/?login_only=1&user=visi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.167.222.24
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.167.222.24 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.41.4.168
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 108.41.4.168 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.131.152.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 135.131.152.141 - visionsolutionshospitalcom "GET /login/?login_only=1&user=visionsolutionshospitalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospitalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.83.18.251
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 184.83.18.251 - visionso "GET /login/?login_only=1&user=visionso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.172.170.101
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.172.170.101 - visions "GET /login/?login_only=1&user=visions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.31.198.129
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.31.198.129 - vis "GET /login/?login_only=1&user=vis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vis (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 14:42:23 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Un2y3ztHTMAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 14:43:46 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<MlWi5DtHJsWi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 31 14:43:48 host2 sshd[1141212]: Disconnected from invalid user developer 177.44.220.67 port 41958 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 14:43:54 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<HYQU5TtHeI1CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Dec 31 14:45:11 host2 sshd[1143057]: Disconnected from invalid user test 191.242.48.147 port 41308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 14:44:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<nTDG6DtHAs9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 31 14:45:16 host2 sshd[1143178]: Disconnected from invalid user almox 177.44.220.67 port 33344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Dec 31 14:45:53 host2 sshd[1144045]: Disconnected from invalid user ubuntu 191.242.48.147 port 53038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.242.48.147
country_id: 3469034
description:
Dec 31 14:46:30 host2 sshd[1144872]: Disconnected from invalid user qiyuesuo 191.242.48.147 port 36538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 31 14:47:13 host2 sshd[1145710]: Disconnected from invalid user ubuntu 177.44.220.67 port 40532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 31 14:48:33 host2 sshd[1147260]: Disconnected from invalid user developer 177.44.220.67 port 35918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.171
country_id: 2510769
description:
Dec 31 14:48:48 host2 sshd[1147520]: Disconnected from invalid user admin 92.191.96.171 port 57968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.190.103
country_id: 1643084
description:
Dec 31 14:48:55 host2 sshd[1147566]: Disconnected from invalid user almox 116.193.190.103 port 57628 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 31 14:48:58 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, TLS, session=<rShZ9ztHwqw26lCA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.190.103
country_id: 1643084
description:
Dec 31 14:49:43 host2 sshd[1148493]: Disconnected from invalid user client1 116.193.190.103 port 50756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 31 14:49:51 host2 sshd[1148679]: Disconnected from invalid user ali 177.44.220.67 port 59532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 14:49:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<K4ir+jtHMMWeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Dec 31 14:50:13 host2 sshd[1149231]: Disconnected from invalid user developer 191.242.48.147 port 50428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.171
country_id: 2510769
description:
Dec 31 14:51:14 host2 sshd[1150326]: Disconnected from invalid user eli 92.191.96.171 port 40004 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.171
country_id: 2510769
description:
Dec 31 14:51:54 host2 sshd[1150995]: Disconnected from invalid user nikola 92.191.96.171 port 59598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 14:52:48 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<AMjvBDxH5JOi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 14:52:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XqMQBDxHgjt100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.171
country_id: 2510769
description:
Dec 31 14:54:32 host2 sshd[1154238]: Disconnected from invalid user ubuntu 92.191.96.171 port 43636 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 14:56:12 host2 pure-ftpd[1156401]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-31 14:56:51 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:35442: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-31 14:57:13 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (urist) [73.137.7.97]:38948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-31 14:57:19 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:53208: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.190.103
country_id: 1643084
description:
Dec 31 14:57:23 host2 sshd[1157749]: Disconnected from invalid user bitrix 116.193.190.103 port 52000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 15:00:42 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ZYAmITxH1Mxnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 31 15:05:28 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<F4FcMjxHb//CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 15:08:10 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<qZ3hOzxH0tcv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.85
country_id: 2328926
description:
Dec 31 15:13:21 host2 pure-ftpd[1176751]: (?@102.204.223.85) [INFO] New connection from 102.204.223.85


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.217
country_id: 3469034
description:
Dec 31 15:14:36 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=177.53.165.217, lip=66.85.158.91, TLS, session=<gf3qUTxHVtaxNaXZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.37
country_id: 798544
description:
Dec 31 15:14:54 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=91.228.33.37, lip=66.85.158.91, TLS, session=<tvwXUzxHLuVb5CEl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 15:15:42 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<AZLRVjxHToAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 15:16:29 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<xGybWTxHZMMzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.235.239.172
country_id: 1269750
description:
2025-12-31 15:18:39 dovecot_plain authenticator failed for H=(JKJEX) [110.235.239.172]:5180: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.94.69.183
country_id: 2661886
description:
2025-12-31 15:19:29 dovecot_plain authenticator failed for H=183-69.soderhamn.com (flifous) [81.94.69.183]:58568: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-31 15:19:33 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (hovent) [73.213.237.28]:35484: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.93.234.6
country_id: 6252001
description:
[2025-12-31 15:20:29 +0530] info [cpaneld] 108.93.234.6 - emlprop2 "GET /login/?login_only=1&user=emlprop2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlprop2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.179.26.107
country_id: 6252001
description:
[2025-12-31 15:20:18 +0530] info [whostmgrd] 104.179.26.107 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.23.24.87
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 165.23.24.87 - emlpropertieslk "GET /login/?login_only=1&user=emlpropertieslk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlpropertieslk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.155.143.253
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 141.155.143.253 - emlprop "GET /login/?login_only=1&user=emlprop&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlprop (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.132.199.118
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.132.199.118 - emlpr "GET /login/?login_only=1&user=emlpr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlpr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.0.66.89
country_id: 6252001
description:
[2025-12-31 15:20:26 +0530] info [cpaneld] 68.0.66.89 - eml "GET /login/?login_only=1&user=eml&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eml (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.234.152.232
country_id: 6252001
description:
[2025-12-31 15:20:24 +0530] info [cpaneld] 76.234.152.232 - emlp "GET /login/?login_only=1&user=emlp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.111.184.243
country_id: 6252001
description:
[2025-12-31 15:20:28 +0530] info [cpaneld] 68.111.184.243 - emlprop1 "GET /login/?login_only=1&user=emlprop1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlprop1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.161.59.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.161.59.173 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.182.45.12
country_id: 6252001
description:
[2025-12-31 15:20:22 +0530] info [cpaneld] 67.182.45.12 - emlpro "GET /login/?login_only=1&user=emlpro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlpro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.187.47.163
country_id: 6252001
description:
[2025-12-31 15:20:27 +0530] info [cpaneld] 66.187.47.163 - em "GET /login/?login_only=1&user=em&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user em (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.20.8.32
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.20.8.32 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.248.238
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.248.238 - emlproperties "GET /login/?login_only=1&user=emlproperties&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlproperties (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.32.77.174
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.32.77.174 - emlprope "GET /login/?login_only=1&user=emlprope&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user emlprope (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 15:21:44 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<7wdkbDxH3tIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 15:21:19 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<F5/tajxHENEzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 15:23:06 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<6LNHcTxHexJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 15:24:23 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<vNzhdTxHKBlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.118.66
country_id: 2215636
description:
Dec 31 15:27:58 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=169.239.118.66, lip=66.85.158.91, TLS, session=<wpnTgTxH3OGp73ZC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 15:28:01 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ovvagjxHIDojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.229
country_id: 953987
description:
Dec 31 15:28:19 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.39.229, lip=66.85.158.91, TLS, session=<niTzgjxHmqRmQCfl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 15:29:04 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<HMiQhjxHareeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-31 15:29:27 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (regly) [78.68.37.25]:42953: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-12-31 15:30:50 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:34372: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-12-31 15:31:04 dovecot_login authenticator failed for H=([82.102.149.88]) [82.102.149.88]:44577: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 15:31:16 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<cUKCjjxHutueRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 15:31:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JivujzxHMJov/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.10
country_id: 3017382
description:
Dec 31 15:36:10 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.10, lip=66.85.158.92, session=<CtQdoDxHQdZbxJgK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.11
country_id: 3017382
description:
Dec 31 15:36:20 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.11, lip=66.85.158.92, session=<kw27oDxHBe5bxJgL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.14
country_id: 3017382
description:
Dec 31 15:36:37 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.14, lip=66.85.158.92, session=<yy3GoTxHMdBbxJgO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 15:36:44 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<kbPwoTxH+MeYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 15:37:25 host2 sshd[1207043]: Disconnected from invalid user admin 2.57.121.112 port 8484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 31 15:38:44 host2 sshd[1208505]: Disconnected from invalid user user 2.57.121.25 port 9809 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.23
country_id: 798549
description:
Dec 31 15:38:46 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.23, lip=66.85.158.91, session=<mSBzqTxHdoZV2ZUX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 15:39:44 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Pki9rDxHlLcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 15:44:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<HsM6vDxHDCwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 15:43:27 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<fdwKujxHmo9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 15:44:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<e6dWvzxHKtieRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 15:44:44 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<YTOhvjxH5Dii8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Dec 31 15:46:53 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JqV0xjxHfNlChJl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 15:47:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ggL1xjxHvGV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 15:50:00 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<0mx+0TxH+I6eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 15:50:11 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<xiMd0jxHiNmi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 15:51:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<FLBz1zxHrJpCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.87.248.223
country_id: 732800
description:
Dec 31 15:54:37 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=95.87.248.223, lip=66.85.158.91, TLS, session=<YWYh4TxH2OJfV/jf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.230.144
country_id: 1269750
description:
Dec 31 15:54:44 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<marketing>, method=PLAIN, rip=122.187.230.144, lip=66.85.158.91, session=<VOtU4jxHAqd6u+aQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 15:58:07 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<e66F7jxHFJNnmud6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.127.17.103
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 23.127.17.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.8.102.251
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.8.102.251 - askinternationalconsortiumcom "GET /login/?login_only=1&user=askinternationalconsortiumcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalconsortiumcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.85.94.172
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.85.94.172 - askinter "GET /login/?login_only=1&user=askinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.178.165.46
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.178.165.46 - askint "GET /login/?login_only=1&user=askint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.209.58
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.209.58 - askin "GET /login/?login_only=1&user=askin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.31.2.36
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.31.2.36 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.57.253
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.57.253 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.212.53.143
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.212.53.143 - askinternationalconsortium "GET /login/?login_only=1&user=askinternationalconsortium&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalconsortium (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.209.1.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.209.1.55 - askinte "GET /login/?login_only=1&user=askinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.159.173.99
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.159.173.99 - askinte1 "GET /login/?login_only=1&user=askinte1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte1 (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 15:59:12 host2 pure-ftpd[1232900]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.230.247.37
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.230.247.37 - askinte2 "GET /login/?login_only=1&user=askinte2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.172.189.39
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.172.189.39 - aski "GET /login/?login_only=1&user=aski&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aski (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.244.227.14
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.244.227.14 - ask "GET /login/?login_only=1&user=ask&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ask (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.198.136
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 204.111.198.136 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.87.153.219
country_id: 1819730
description:
Dec 31 16:08:43 host2 sshd[1244446]: Disconnected from invalid user prueba 183.87.153.219 port 54786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.39.223
country_id: 3932488
description:
Dec 31 16:09:10 host2 sshd[1245296]: Disconnected from invalid user hub 161.132.39.223 port 58218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.91.55
country_id: 3624060
description:
2025-12-31 16:10:08 dovecot_login authenticator failed for H=([186.177.91.55]) [186.177.91.55]:43983: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-31 16:10:38 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:36542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-31 16:10:52 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:57632: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.39.223
country_id: 3932488
description:
Dec 31 16:12:52 host2 sshd[1249942]: Disconnected from invalid user user1 161.132.39.223 port 58376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.54
country_id: 241170
description:
Dec 31 16:13:06 host2 sshd[1250220]: Disconnected from invalid user hugo 212.11.64.54 port 36184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.87.153.219
country_id: 1819730
description:
Dec 31 16:13:09 host2 sshd[1250260]: Disconnected from invalid user anna 183.87.153.219 port 43822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.39.223
country_id: 3932488
description:
Dec 31 16:12:10 host2 sshd[1249307]: Disconnected from invalid user marie 161.132.39.223 port 58320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.39.223
country_id: 3932488
description:
Dec 31 16:13:37 host2 sshd[1250676]: Disconnected from invalid user libuuid 161.132.39.223 port 58432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.87.153.219
country_id: 1819730
description:
Dec 31 16:13:52 host2 sshd[1251002]: Disconnected from invalid user sinus1 183.87.153.219 port 55042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.11.64.54
country_id: 241170
description:
Dec 31 16:14:08 host2 sshd[1251299]: Disconnected from invalid user lorenza 212.11.64.54 port 48250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.8.173
country_id: 298795
description:
Dec 31 16:14:10 host2 sshd[1251331]: Disconnected from invalid user ubuntu 94.102.8.173 port 42854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.39.223
country_id: 3932488
description:
Dec 31 16:14:19 host2 sshd[1251580]: Disconnected from invalid user apps 161.132.39.223 port 58492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.87.153.219
country_id: 1819730
description:
Dec 31 16:14:32 host2 sshd[1251828]: Disconnected from invalid user prasad 183.87.153.219 port 33944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.87.153.219
country_id: 1819730
description:
Dec 31 16:15:10 host2 sshd[1252506]: Disconnected from invalid user pula 183.87.153.219 port 33248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.142.247.48
country_id: 6252001
description:
2025-12-31 16:17:52 dovecot_login authenticator failed for H=(uVEr09N4fZ) [98.142.247.48]:57340: 535 Incorrect authentication data (set_id=accounts@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 16:18:28 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<x5RKNz1HlJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 16:19:08 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<KwyqOT1HlEJniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.142.247.48
country_id: 6252001
description:
2025-12-31 16:20:55 dovecot_login authenticator failed for H=(Sk9BUZSPr) [98.142.247.48]:63083: 535 Incorrect authentication data (set_id=accounts@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 16:24:55 host2 sshd[1265072]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 16:27:20 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<4ucDVz1HAukzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.27
country_id: 3865483
description:
Dec 31 16:27:56 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.0.251.27, lip=66.85.158.91, TLS, session=<wpEqWD1HLqSzAPsb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.138
country_id: 1269750
description:
Dec 31 16:28:17 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.30.83.138, lip=66.85.158.91, TLS, session=<iJtqWT1HYZhnHlOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 16:29:19 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0lUTXj1HXMEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 16:29:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Bj9PYD1HTJkyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 16:30:54 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<4jjBYz1HsrOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 16:31:46 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<uwzNZj1HGjZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 16:32:16 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<AoymaD1HNMwzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-31 16:33:18 dovecot_plain authenticator failed for H=c-73-0-235-30.hsd1.fl.comcast.net (chics) [73.0.235.30]:56276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 31 16:35:17 host2 sshd[1278612]: Disconnected from invalid user bitrix 181.116.220.11 port 53693 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 31 16:36:26 host2 sshd[1279982]: Disconnected from invalid user ubuntu 45.182.207.45 port 43010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 16:39:45 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<6Hlmgz1HRNcvWBNS>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 31 16:41:04 host2 sshd[1286305]: Received disconnect from 45.182.207.45 port 48224:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 16:42:06 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<YAzViz1HtoZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 16:41:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iO4viz1HJKMv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.45.116.40
country_id: 6252001
description:
[2025-12-31 16:42:47 +0530] info [cpaneld] 130.45.116.40 - mypr "GET /login/?login_only=1&user=mypr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mypr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.8.15.231
country_id: 6252001
description:
[2025-12-31 16:42:40 +0530] info [whostmgrd] 204.8.15.231 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.109.85.145
country_id: 6252001
description:
[2025-12-31 16:42:45 +0530] info [cpaneld] 68.109.85.145 - myprot "GET /login/?login_only=1&user=myprot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.124.57.144
country_id: 6252001
description:
[2025-12-31 16:42:49 +0530] info [cpaneld] 24.124.57.144 - my "GET /login/?login_only=1&user=my&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user my (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.10.144.238
country_id: 6252001
description:
[2025-12-31 16:42:48 +0530] info [cpaneld] 24.10.144.238 - myp "GET /login/?login_only=1&user=myp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.36.120.52
country_id: 6252001
description:
[2025-12-31 16:42:50 +0530] info [cpaneld] 98.36.120.52 - myprote1 "GET /login/?login_only=1&user=myprote1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.217.8.58
country_id: 6252001
description:
[2025-12-31 16:42:41 +0530] info [cpaneld] 206.217.8.58 - myproteinboxlk "GET /login/?login_only=1&user=myproteinboxlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myproteinboxlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.245.181.15
country_id: 6252001
description:
[2025-12-31 16:42:44 +0530] info [cpaneld] 97.245.181.15 - myprote "GET /login/?login_only=1&user=myprote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.59.81
country_id: 6252001
description:
[2025-12-31 16:42:46 +0530] info [cpaneld] 184.164.59.81 - mypro "GET /login/?login_only=1&user=mypro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mypro (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 16:42:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<YitvjT1Hduhn9M4G>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.229.173.134
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.229.173.134 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.103.133.130
country_id: 6252001
description:
[2025-12-31 16:42:39 +0530] info [cpaneld] 99.103.133.130 - myproteinbox "GET /login/?login_only=1&user=myproteinbox&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.174.88.185
country_id: 6252001
description:
[2025-12-31 16:42:37 +0530] info [cpaneld] 206.174.88.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.128.6.74
country_id: 6252001
description:
[2025-12-31 16:42:42 +0530] info [cpaneld] 104.128.6.74 - myprotei "GET /login/?login_only=1&user=myprotei&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprotei (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.20.8.204
country_id: 6252001
description:
[2025-12-31 16:42:51 +0530] info [cpaneld] 67.20.8.204 - myprote2 "GET /login/?login_only=1&user=myprote2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user myprote2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 31 16:43:18 host2 sshd[1288963]: Disconnected from invalid user kocom 181.116.220.11 port 59294 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 31 16:44:50 host2 sshd[1290841]: Disconnected from invalid user steam 181.116.220.11 port 53597 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 16:44:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<D0/dlT1HUkUjupN+>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 31 16:46:05 host2 sshd[1292876]: Received disconnect from 45.182.207.45 port 40600:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 31 16:46:25 host2 sshd[1293347]: Disconnected from invalid user user 2.57.121.25 port 35917 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 31 16:46:37 host2 sshd[1293563]: Disconnected from invalid user admin 45.182.207.45 port 50040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 16:46:17 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<wl7Hmj1HZMWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 16:47:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<EUiqoD1HgICi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 31 16:47:36 host2 sshd[1294777]: Disconnected from invalid user postgres 45.182.207.45 port 52130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 31 16:47:56 host2 sshd[1295135]: Disconnected from invalid user testuser 181.116.220.11 port 40485 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.51.216
country_id: 1269750
description:
2025-12-31 16:48:51 dovecot_plain authenticator failed for H=(B9MP3) [49.36.51.216]:53708: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 16:49:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<yxappD1H6qWeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.169.171.169
country_id: 6252001
description:
2025-12-31 16:50:16 dovecot_login authenticator failed for H=(69-169-171-169.ip.fdtnet.net) [69.169.171.169]:54171: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-31 16:50:30 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:59844: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 31 16:50:57 host2 sshd[1298607]: Disconnected from invalid user jlin 181.116.220.11 port 59341 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Dec 31 16:51:55 host2 sshd[1299725]: Disconnected from invalid user ida 174.84.246.11 port 38346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 31 16:51:56 host2 sshd[1299741]: Disconnected from invalid user dmdba 152.200.217.230 port 41826 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 31 16:53:55 host2 sshd[1302345]: Disconnected from invalid user postgres 152.200.217.230 port 34462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 31 16:53:18 host2 sshd[1301607]: Disconnected from invalid user app 152.200.217.230 port 55740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.195.251.43
country_id: 3573591
description:
2025-12-31 16:53:36 dovecot_login authenticator failed for H=([186.195.251.41]) [186.195.251.43]:54849: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.12.135
country_id: 2077456
description:
2025-12-31 16:53:52 dovecot_login authenticator failed for H=([101.168.12.135]) [101.168.12.135]:32798: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 31 16:54:33 host2 sshd[1303411]: Disconnected from invalid user ubuntu 152.200.217.230 port 41418 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 16:55:30 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<zS24uz1HWrRnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 31 16:55:48 host2 sshd[1304986]: Disconnected from invalid user mahdi 152.200.217.230 port 55330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 31 16:56:07 host2 sshd[1305505]: Disconnected from invalid user ida 103.179.27.94 port 57162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 31 16:56:26 host2 sshd[1305856]: Disconnected from invalid user ubuntu 103.98.176.164 port 34874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Dec 31 16:56:31 host2 sshd[1305939]: Disconnected from invalid user test 174.84.246.11 port 58880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 16:56:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<7oXnvz1HcqIFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 31 16:56:50 host2 sshd[1306365]: Disconnected from invalid user mailtest 103.179.27.94 port 49116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Dec 31 16:57:36 host2 sshd[1307378]: Disconnected from invalid user chromeuser 174.84.246.11 port 44758 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 16:58:11 host2 sshd[1308108]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 31 16:58:21 host2 sshd[1308384]: Disconnected from invalid user actions 103.98.176.164 port 45224 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.84.246.11
country_id: 6252001
description:
Dec 31 16:58:41 host2 sshd[1308714]: Disconnected from invalid user admin 174.84.246.11 port 58888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 31 16:59:32 host2 sshd[1309645]: Disconnected from invalid user dmdba 103.179.27.94 port 35032 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.88.70.222
country_id: 6252001
description:
[2025-12-31 16:59:18 +0530] info [cpaneld] 108.88.70.222 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.101.131
country_id: 6252001
description:
[2025-12-31 16:59:21 +0530] info [whostmgrd] 73.158.101.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.106.32.134
country_id: 6252001
description:
[2025-12-31 16:59:20 +0530] info [cpaneld] 149.106.32.134 - dataesite "GET /login/?login_only=1&user=dataesite&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataesite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.77.244.160
country_id: 6252001
description:
[2025-12-31 16:59:22 +0530] info [cpaneld] 69.77.244.160 - dataesitelk "GET /login/?login_only=1&user=dataesitelk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataesitelk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.83.250
country_id: 6252001
description:
[2025-12-31 16:59:23 +0530] info [cpaneld] 172.56.83.250 - dataesit "GET /login/?login_only=1&user=dataesit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.7.204
country_id: 6252001
description:
[2025-12-31 16:59:29 +0530] info [cpaneld] 98.37.7.204 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.187.32.67
country_id: 6252001
description:
[2025-12-31 16:59:17 +0530] info [cpaneld] 97.187.32.67 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-31 16:59:51 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (unhaedae) [67.172.54.29]:58420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.149.154.117
country_id: 6252001
description:
[2025-12-31 16:59:26 +0530] info [cpaneld] 73.149.154.117 - datae "GET /login/?login_only=1&user=datae&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user datae (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.36.62.62
country_id: 6252001
description:
[2025-12-31 16:59:28 +0530] info [cpaneld] 69.36.62.62 - dat "GET /login/?login_only=1&user=dat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dat (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 16:59:24 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<G0SuyT1HXoFCdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.241.17.19
country_id: 6252001
description:
[2025-12-31 16:59:27 +0530] info [cpaneld] 131.241.17.19 - data "GET /login/?login_only=1&user=data&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user data (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.74.112.107
country_id: 6252001
description:
[2025-12-31 16:59:24 +0530] info [cpaneld] 108.74.112.107 - dataesi "GET /login/?login_only=1&user=dataesi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataesi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.124.209
country_id: 6252001
description:
[2025-12-31 16:59:25 +0530] info [cpaneld] 216.147.124.209 - dataes "GET /login/?login_only=1&user=dataes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataes (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 31 17:00:11 host2 sshd[1310655]: Disconnected from invalid user tempuser 103.179.27.94 port 52114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.222.206
country_id: 192950
description:
Dec 31 17:02:17 host2 sshd[1313470]: Invalid user secondcoffeeinternational from 41.203.222.206 port 17717


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 17:02:18 host2 pure-ftpd[1313509]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.255
country_id: 690791
description:
Dec 31 17:03:25 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=176.103.2.255, lip=66.85.158.91, TLS, session=<5Xb31j1HMaKwZwL/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.132
country_id: 298795
description:
Dec 31 17:03:48 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=149.34.211.132, lip=66.85.158.91, TLS, session=<NY9X2D1HrYmVItOE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 17:04:16 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<oMIa2z1Hmo2eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 31 17:04:18 host2 sshd[1316303]: Disconnected from invalid user actions 78.89.154.59 port 41550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 31 17:05:09 host2 sshd[1317464]: Disconnected from invalid user test 78.89.154.59 port 59140 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Dec 31 17:06:00 host2 sshd[1318503]: Disconnected from invalid user saeed 78.89.154.59 port 34456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 17:06:54 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<lpOG5D1HpNSYNcU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.162.164
country_id: 6252001
description:
[2025-12-31 17:07:54 +0530] info [cpaneld] 24.61.162.164 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.133.156.55
country_id: 6252001
description:
[2025-12-31 17:07:55 +0530] info [whostmgrd] 76.133.156.55 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.18.84.80
country_id: 6252001
description:
[2025-12-31 17:07:56 +0530] info [cpaneld] 38.18.84.80 - bostonlankacom "GET /login/?login_only=1&user=bostonlankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonlankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.113.147.36
country_id: 6252001
description:
[2025-12-31 17:07:57 +0530] info [cpaneld] 69.113.147.36 - bostonla "GET /login/?login_only=1&user=bostonla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.102.186.249
country_id: 6252001
description:
[2025-12-31 17:08:06 +0530] info [cpaneld] 75.102.186.249 - bo "GET /login/?login_only=1&user=bo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.168.17.224
country_id: 6252001
description:
[2025-12-31 17:07:58 +0530] info [cpaneld] 174.168.17.224 - bostonl "GET /login/?login_only=1&user=bostonl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.16.126.10
country_id: 6252001
description:
[2025-12-31 17:08:01 +0530] info [cpaneld] 108.16.126.10 - bosto "GET /login/?login_only=1&user=bosto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bosto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.175.189.238
country_id: 6252001
description:
[2025-12-31 17:08:01 +0530] info [cpaneld] 108.175.189.238 - boston "GET /login/?login_only=1&user=boston&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boston (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.19.2.91
country_id: 6252001
description:
[2025-12-31 17:08:02 +0530] info [cpaneld] 70.19.2.91 - bost "GET /login/?login_only=1&user=bost&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bost (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.27.37
country_id: 6252001
description:
[2025-12-31 17:07:53 +0530] info [cpaneld] 98.97.27.37 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.153.208.233
country_id: 6252001
description:
[2025-12-31 17:07:55 +0530] info [cpaneld] 76.153.208.233 - bostonlanka "GET /login/?login_only=1&user=bostonlanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.218.58.228
country_id: 6252001
description:
[2025-12-31 17:08:05 +0530] info [cpaneld] 66.218.58.228 - bos "GET /login/?login_only=1&user=bos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.93.125.53
country_id: 6252001
description:
[2025-12-31 17:08:08 +0530] info [cpaneld] 64.93.125.53 - bostonl1 "GET /login/?login_only=1&user=bostonl1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.176.121.119
country_id: 6252001
description:
[2025-12-31 17:08:09 +0530] info [cpaneld] 184.176.121.119 - bostonl2 "GET /login/?login_only=1&user=bostonl2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 31 17:08:30 host2 sshd[1321624]: Disconnected from invalid user mahdi 78.89.154.59 port 49412 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:10:21 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CRP88D1HiO0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:11:42 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MrvQ9T1H3NADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:13:44 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BmgP/T1HEqwDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 17:13:47 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56609: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:14:25 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<edCG/z1HzO0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 17:15:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4i/HBD5HWSFniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:15:46 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<GbJSBD5HutMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:16:29 host2 dovecot[988630]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<wk/qBj5HBIYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:17:15 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MpqpCT5HFMMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:18:17 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JMxRDT5HCuoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:19:23 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<HDZEET5HLsUDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2025-12-31 17:19:45 dovecot_plain authenticator failed for H=(untie) [195.133.156.119]:39933: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 17:20:29 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<WGkTFT5Haq2eRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.165.223
country_id: 6252001
description:
[2025-12-31 17:23:30 +0530] info [cpaneld] 98.97.165.223 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.215.3.25
country_id: 6252001
description:
[2025-12-31 17:23:36 +0530] info [cpaneld] 134.215.3.25 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.29.31
country_id: 6252001
description:
[2025-12-31 17:23:37 +0530] info [cpaneld] 104.5.29.31 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.95.125.176
country_id: 6252001
description:
[2025-12-31 17:23:39 +0530] info [cpaneld] 68.95.125.176 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.8.161.240
country_id: 6252001
description:
[2025-12-31 17:23:38 +0530] info [cpaneld] 99.8.161.240 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.130.124.9
country_id: 6252001
description:
[2025-12-31 17:23:29 +0530] info [cpaneld] 174.130.124.9 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.25.56.26
country_id: 6252001
description:
[2025-12-31 17:23:28 +0530] info [cpaneld] 216.25.56.26 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.115.197.29
country_id: 6252001
description:
[2025-12-31 17:23:31 +0530] info [whostmgrd] 24.115.197.29 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.228.45.177
country_id: 6252001
description:
[2025-12-31 17:23:32 +0530] info [cpaneld] 129.228.45.177 - kamecholk "GET /login/?login_only=1&user=kamecholk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecholk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.151.19.144
country_id: 6252001
description:
[2025-12-31 17:23:35 +0530] info [cpaneld] 99.151.19.144 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2025-12-31 17:26:25 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:42822: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-31 17:26:42 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:51105: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.53
country_id: 6252001
description:
Dec 31 17:26:23 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<R8ZLKj5HRLkUQGg1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 17:28:52 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Qn4WMz5H2rov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 17:29:18 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<YBCWND5HNJIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 17:29:22 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<3fbZND5HjICeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.227.99.216
country_id: 6252001
description:
Dec 31 17:29:54 host2 pure-ftpd[1349549]: (?@64.227.99.216) [INFO] New connection from 64.227.99.216


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.39.158
country_id: 6251999
description:
Dec 31 17:30:06 host2 pure-ftpd[1349948]: (?@165.227.39.158) [INFO] New connection from 165.227.39.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-31 17:32:03 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (shably) [73.195.211.98]:42702: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.86
country_id: 6252001
description:
Dec 31 17:35:10 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.80.105.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<HpO9ST5H3ukUUGlW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 17:37:48 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<8w8FUz5HoHdo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 17:37:37 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<S/tWUj5HdJMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 17:39:16 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<d/A6WD5Hrft100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Dec 31 17:39:34 host2 sshd[1362277]: Disconnected from invalid user informix 89.44.137.176 port 54990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Dec 31 17:40:38 host2 sshd[1363819]: Disconnected from invalid user www-upload 89.44.137.176 port 44578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.44.137.176
country_id: 798549
description:
Dec 31 17:41:12 host2 sshd[1364670]: Disconnected from invalid user nate 89.44.137.176 port 56758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 17:41:48 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<EzxLYT5HuMNn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Dec 31 17:42:20 host2 sshd[1366247]: Disconnected from invalid user m1 89.44.137.176 port 52948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 17:42:31 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<gEvfYz5H5uszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 17:45:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Szv3bD5HljojupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.103
country_id: 6252001
description:
Dec 31 17:44:31 host2 pure-ftpd[1369043]: (?@40.124.175.103) [INFO] New connection from 40.124.175.103


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 17:44:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<PJlTbD5HwKwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 17:45:53 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mRPxbz5HXrKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 17:47:51 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<YDzzdj5HGoGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 17:48:25 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Lh33eD5HlI+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-31 17:48:29 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:49054: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-31 17:48:12 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:34394: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 17:52:45 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<6tl7iD5H6MYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 17:54:06 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Yl1KjT5Hkr5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 17:58:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<SEsvnT5HRt0vWBNS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.87.55.116
country_id: 6252001
description:
[2025-12-31 18:01:00 +0530] info [cpaneld] 65.87.55.116 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.186.210.125
country_id: 6252001
description:
[2025-12-31 18:01:00 +0530] info [cpaneld] 66.186.210.125 - absolutehomecarenb "GET /login/?login_only=1&user=absolutehomecarenb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolutehomecarenb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.127.216.25
country_id: 6252001
description:
[2025-12-31 18:01:03 +0530] info [cpaneld] 73.127.216.25 - absolutehomecarenbca "GET /login/?login_only=1&user=absolutehomecarenbca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolutehomecarenbca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.6.27.55
country_id: 6252001
description:
[2025-12-31 18:01:05 +0530] info [cpaneld] 99.6.27.55 - absolut "GET /login/?login_only=1&user=absolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.201.214.176
country_id: 6252001
description:
[2025-12-31 18:01:04 +0530] info [cpaneld] 72.201.214.176 - absolute "GET /login/?login_only=1&user=absolute&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.194.84.158
country_id: 6252001
description:
[2025-12-31 18:00:59 +0530] info [cpaneld] 162.194.84.158 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.130.126.218
country_id: 6252001
description:
[2025-12-31 18:01:02 +0530] info [whostmgrd] 69.130.126.218 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.47.250.147
country_id: 6252001
description:
[2025-12-31 18:01:12 +0530] info [cpaneld] 199.47.250.147 - ab "GET /login/?login_only=1&user=ab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.33.137
country_id: 6252001
description:
[2025-12-31 18:01:13 +0530] info [cpaneld] 70.170.33.137 - absolut1 "GET /login/?login_only=1&user=absolut1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolut1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.71.214.209
country_id: 6252001
description:
[2025-12-31 18:01:06 +0530] info [cpaneld] 75.71.214.209 - absolu "GET /login/?login_only=1&user=absolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.23.76.115
country_id: 6252001
description:
[2025-12-31 18:01:09 +0530] info [cpaneld] 165.23.76.115 - abso "GET /login/?login_only=1&user=abso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.117.20.244
country_id: 6252001
description:
[2025-12-31 18:01:10 +0530] info [cpaneld] 23.117.20.244 - abs "GET /login/?login_only=1&user=abs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.156.111.194
country_id: 6252001
description:
[2025-12-31 18:01:14 +0530] info [cpaneld] 24.156.111.194 - absolut2 "GET /login/?login_only=1&user=absolut2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolut2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.144.148
country_id: 6252001
description:
[2025-12-31 18:01:08 +0530] info [cpaneld] 73.92.144.148 - absol "GET /login/?login_only=1&user=absol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-31 18:02:40 dovecot_plain authenticator failed for H=(lagis) [65.20.205.197]:55939: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-31 18:03:39 dovecot_plain authenticator failed for H=(deringuse) [176.113.155.132]:55303: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-31 18:04:08 dovecot_login authenticator failed for H=([84.213.189.27]) [84.213.189.27]:48000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 18:04:12 host2 sshd[1394819]: Disconnected from invalid user admin 2.57.121.112 port 61839 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-31 18:04:53 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:42658: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.210.93.132
country_id: 6252001
description:
[2025-12-31 18:05:36 +0530] info [whostmgrd] 108.210.93.132 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.218.220.70
country_id: 6252001
description:
[2025-12-31 18:05:41 +0530] info [cpaneld] 104.218.220.70 - seyaw "GET /login/?login_only=1&user=seyaw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyaw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.7.70.48
country_id: 6252001
description:
[2025-12-31 18:05:42 +0530] info [cpaneld] 71.7.70.48 - seya "GET /login/?login_only=1&user=seya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.93.118.81
country_id: 6252001
description:
[2025-12-31 18:05:44 +0530] info [cpaneld] 72.93.118.81 - se "GET /login/?login_only=1&user=se&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user se (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.12.6.98
country_id: 6252001
description:
[2025-12-31 18:05:32 +0530] info [cpaneld] 104.12.6.98 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.216.39.136
country_id: 6252001
description:
[2025-12-31 18:05:36 +0530] info [cpaneld] 73.216.39.136 - seyawin "GET /login/?login_only=1&user=seyawin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.187.17
country_id: 6252001
description:
[2025-12-31 18:05:38 +0530] info [cpaneld] 75.4.187.17 - seyawincom "GET /login/?login_only=1&user=seyawincom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawincom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.167.196
country_id: 6252001
description:
[2025-12-31 18:05:39 +0530] info [cpaneld] 172.56.167.196 - seyawi "GET /login/?login_only=1&user=seyawi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.169.53.20
country_id: 6252001
description:
[2025-12-31 18:05:43 +0530] info [cpaneld] 73.169.53.20 - sey "GET /login/?login_only=1&user=sey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sey (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 18:05:23 host2 pure-ftpd[1396546]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.43.71.191
country_id: 6252001
description:
[2025-12-31 18:05:34 +0530] info [cpaneld] 149.43.71.191 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 18:06:58 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<+jlIuz5HXJpCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 18:11:53 host2 sshd[1405423]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 18:13:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<GAQ40z5HfJEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 18:13:53 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nisJ1D5H9Exniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.155.204.203
country_id: 1880251
description:
2025-12-31 18:17:44 dovecot_login authenticator failed for H=(124.155.204-203.unknown.starhub.net.sg) [124.155.204.203]:48405: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-12-31 18:18:05 dovecot_login authenticator failed for H=([189.108.215.39]) [189.108.215.39]:58507: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 31 18:21:50 host2 pure-ftpd[1417785]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 31 18:21:47 host2 pure-ftpd[1417732]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.252.209.165
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.252.209.165 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.50.174
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.50.174 - gemtrail "GET /login/?login_only=1&user=gemtrail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtrail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.186.159.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.186.159.11 - gemtr "GET /login/?login_only=1&user=gemtr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.27.34
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.31.27.34 - gemtra "GET /login/?login_only=1&user=gemtra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 18:28:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rnGSCD9HkNeeRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.196.96.17
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.196.96.17 - gem "GET /login/?login_only=1&user=gem&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gem (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.250.56.227
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 170.250.56.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.207.248.70
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.207.248.70 - gemtrai "GET /login/?login_only=1&user=gemtrai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtrai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.48.150.139
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 99.48.150.139 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.159.136
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 143.105.159.136 - ge "GET /login/?login_only=1&user=ge&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ge (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.46.78.85
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.46.78.85 - gemtrails "GET /login/?login_only=1&user=gemtrails&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.252.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.4.252.114 - gemtrailscom "GET /login/?login_only=1&user=gemtrailscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtrailscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.26.11.20
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.26.11.20 - gemt "GET /login/?login_only=1&user=gemt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemt (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 18:29:47 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7MDvDD9HfL0jupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.162.41.187
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.162.41.187 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.50.124
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.93.50.124 - melanifinefood "GET /login/?login_only=1&user=melanifinefood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.60.20.196
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 204.60.20.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 57.138.137.253
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 57.138.137.253 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.99.150.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.99.150.162 - melanifi "GET /login/?login_only=1&user=melanifi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.25.251.108
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.25.251.108 - melanif1 "GET /login/?login_only=1&user=melanif1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 18:33:08 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<4b7lGD9HKVt100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.49.127.203
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.49.127.203 - melanif "GET /login/?login_only=1&user=melanif&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.198.154.178
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.198.154.178 - melani "GET /login/?login_only=1&user=melani&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melani (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.90.210.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.90.210.16 - melan "GET /login/?login_only=1&user=melan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.154.219.23
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.154.219.23 - melanifinefoodcom "GET /login/?login_only=1&user=melanifinefoodcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinefoodcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.223.192
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.31.223.192 - mela "GET /login/?login_only=1&user=mela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.7.46.104
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.7.46.104 - mel "GET /login/?login_only=1&user=mel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.102.23.231
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.102.23.231 - melanif2 "GET /login/?login_only=1&user=melanif2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.65.78.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 174.65.78.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 18:37:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<7vAgKT9HgKOYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 18:40:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<5FR3Mz9HWoUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 18:41:20 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ZjY/Nj9HSuhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 18:41:31 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ncfgNj9HgNyeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-31 18:41:52 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:47578: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 18:43:51 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<UVY5Pz9HGOei8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 18:45:06 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<OgKyQz9HHlxo7MS0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 18:45:23 host2 sshd[1446500]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 31 18:45:44 host2 pure-ftpd[1446879]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 18:45:43 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<D0HhRT9HFmMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2025-12-31 18:45:16 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:36979: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 31 18:45:43 host2 pure-ftpd[1446854]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 18:47:10 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<sJYOSz9HXICeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 18:49:09 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<0vwnUj9HWsUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.110.37.179
country_id: 3077311
description:
Dec 31 18:50:59 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=79.110.37.179, lip=66.85.158.91, TLS, session=<8hLlVz9Hza5PbiWz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 18:50:39 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ZvuCVz9HiiKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.230
country_id: 3469034
description:
Dec 31 18:51:21 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=190.89.137.230, lip=66.85.158.91, TLS, session=<IlP+WD9HDLu+WYnm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 18:52:47 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<L0QnXz9HaoRnmud6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.229.184.123
country_id: 6252001
description:
[2025-12-31 18:53:04 +0530] info [cpaneld] 24.229.184.123 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.131.151
country_id: 6252001
description:
[2025-12-31 18:53:03 +0530] info [cpaneld] 172.59.131.151 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.180.59.199
country_id: 6252001
description:
[2025-12-31 18:53:07 +0530] info [whostmgrd] 98.180.59.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.165.5.142
country_id: 6252001
description:
[2025-12-31 18:53:06 +0530] info [cpaneld] 97.165.5.142 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.9.218
country_id: 6252001
description:
[2025-12-31 18:53:12 +0530] info [cpaneld] 38.43.9.218 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.153.123
country_id: 6252001
description:
[2025-12-31 18:53:14 +0530] info [cpaneld] 73.235.153.123 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.219.62.43
country_id: 6252001
description:
[2025-12-31 18:53:15 +0530] info [cpaneld] 107.219.62.43 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.19.19
country_id: 6252001
description:
[2025-12-31 18:53:08 +0530] info [cpaneld] 71.193.19.19 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.78.172
country_id: 6252001
description:
[2025-12-31 18:53:10 +0530] info [cpaneld] 73.41.78.172 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.227.220.190
country_id: 6252001
description:
[2025-12-31 18:53:13 +0530] info [cpaneld] 50.227.220.190 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.206.19.162
country_id: 6252001
description:
[2025-12-31 18:53:16 +0530] info [cpaneld] 107.206.19.162 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.187.1.100
country_id: 6252001
description:
[2025-12-31 18:53:18 +0530] info [cpaneld] 173.187.1.100 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.37.49.240
country_id: 6252001
description:
[2025-12-31 18:53:18 +0530] info [cpaneld] 100.37.49.240 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 18:54:04 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<0vTJYz9HaJIzTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.22.195.31
country_id: 6252001
description:
[2025-12-31 18:53:11 +0530] info [cpaneld] 134.22.195.31 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 18:57:58 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<zVOycT9HKuqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 19:00:50 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<btTsez9HOpoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 19:04:25 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3GfEiD9H3tIv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 19:08:33 host2 pure-ftpd[1475639]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 19:11:01 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<hBFdoD9Hyg5niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-31 19:12:07 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (pance) [73.129.57.71]:36718: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 19:15:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<D34nsD9Hop1CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.186
country_id: 3144096
description:
2025-12-31 19:17:36 dovecot_login authenticator failed for H=(186-161-97-62.cust.smartcall.no) [62.97.161.186]:45273: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2025-12-31 19:17:48 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:55282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 19:18:35 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<VWxyuz9H+OUvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-31 19:19:10 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (moustobed) [87.103.126.54]:54204: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 31 19:19:23 host2 sshd[1489292]: Disconnected from invalid user croceiris 200.155.38.219 port 39476 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.203.21.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.203.21.122 - tfab "GET /login/?login_only=1&user=tfab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tfab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.54.128.223
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.54.128.223 - tfa "GET /login/?login_only=1&user=tfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tfa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.159.151.106
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.159.151.106 - tf "GET /login/?login_only=1&user=tf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.81.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.81.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.202.194.92
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 107.202.194.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.70.11.188
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.70.11.188 - tfablk "GET /login/?login_only=1&user=tfablk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 31 19:20:10 host2 sshd[1490446]: Disconnected from invalid user suporte 200.155.38.219 port 29651 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.167.108.242
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.167.108.242 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 31 19:21:48 host2 sshd[1492511]: Disconnected from invalid user db2inst1 200.155.38.219 port 10295 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 19:26:19 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<vdgT1z9HmwN100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 19:27:21 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<f8fO2j9HCtqeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-31 19:29:15 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (osadiance) [24.15.216.41]:47262: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 19:30:00 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<e+ZC5D9HHIMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 19:32:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3pBj7T9HmuIFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-31 19:32:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (valial) [87.103.126.54]:26615: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.248.242.186
country_id: 2921044
description:
Dec 31 19:39:17 host2 sshd[1514090]: Disconnected from invalid user rafael 195.248.242.186 port 59392 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 19:40:50 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<SzMEC0BH/oln9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.141
country_id: 1814991
description:
Dec 31 19:41:26 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.241.80.141, lip=66.85.158.91, TLS, session=<NIRNDUBHesW88VCN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.93
country_id: 3057568
description:
Dec 31 19:41:26 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.102.232.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xvdMDUBHasWVZuhd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 19:41:52 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<seixDkBHFLCi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.248.242.186
country_id: 2921044
description:
Dec 31 19:42:36 host2 sshd[1517899]: Disconnected from invalid user ankit 195.248.242.186 port 55120 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.248.242.186
country_id: 2921044
description:
Dec 31 19:43:09 host2 sshd[1518425]: Disconnected from invalid user werkstatt 195.248.242.186 port 35330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.248.242.186
country_id: 2921044
description:
Dec 31 19:44:12 host2 sshd[1519505]: Disconnected from invalid user customer 195.248.242.186 port 36224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 19:45:20 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<x1UeG0BHhrWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 19:45:22 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hto9G0BH/FYjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec 31 19:48:31 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sbuZJkBHYrpChJl6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.48
country_id: 6252001
description:
Dec 31 19:51:11 host2 pure-ftpd[1528653]: (?@167.94.146.48) [INFO] New connection from 167.94.146.48


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 19:51:38 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<gbmgMUBH8uhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 19:52:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<GSv4NEBHdqJo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 19:52:24 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<UtFjNEBH/tgv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 19:52:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<z02DNEBHjHyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.176.34.117
country_id: 1269750
description:
2025-12-31 19:54:55 dovecot_plain authenticator failed for H=(P1G39) [123.176.34.117]:51603: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.82.50
country_id: 6252001
description:
[2025-12-31 19:57:35 +0530] info [cpaneld] 24.61.82.50 - millenn1 "GET /login/?login_only=1&user=millenn1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenn1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.57.19.3
country_id: 6252001
description:
[2025-12-31 19:57:23 +0530] info [cpaneld] 204.57.19.3 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.200.252
country_id: 6252001
description:
[2025-12-31 19:57:28 +0530] info [cpaneld] 73.23.200.252 - millenn "GET /login/?login_only=1&user=millenn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.37.160.246
country_id: 6252001
description:
[2025-12-31 19:57:30 +0530] info [cpaneld] 50.37.160.246 - mille "GET /login/?login_only=1&user=mille&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mille (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.215.134.149
country_id: 6252001
description:
[2025-12-31 19:57:25 +0530] info [cpaneld] 69.215.134.149 - millenniumagro "GET /login/?login_only=1&user=millenniumagro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenniumagro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.71.179.211
country_id: 6252001
description:
[2025-12-31 19:57:33 +0530] info [cpaneld] 209.71.179.211 - mil "GET /login/?login_only=1&user=mil&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mil (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.248.8.67
country_id: 6252001
description:
[2025-12-31 19:57:36 +0530] info [cpaneld] 173.248.8.67 - millenn2 "GET /login/?login_only=1&user=millenn2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenn2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.17.145.79
country_id: 6252001
description:
[2025-12-31 19:57:26 +0530] info [whostmgrd] 108.17.145.79 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.115.34.253
country_id: 6252001
description:
[2025-12-31 19:57:29 +0530] info [cpaneld] 98.115.34.253 - millen "GET /login/?login_only=1&user=millen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.20.76.61
country_id: 6252001
description:
[2025-12-31 19:57:34 +0530] info [cpaneld] 99.20.76.61 - mi "GET /login/?login_only=1&user=mi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.107.249
country_id: 6252001
description:
[2025-12-31 19:57:26 +0530] info [cpaneld] 108.48.107.249 - millenniumagrolk "GET /login/?login_only=1&user=millenniumagrolk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenniumagrolk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.214.206
country_id: 6252001
description:
[2025-12-31 19:57:32 +0530] info [cpaneld] 67.188.214.206 - mill "GET /login/?login_only=1&user=mill&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mill (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.121.195.112
country_id: 6252001
description:
[2025-12-31 19:57:24 +0530] info [cpaneld] 23.121.195.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.114.136.17
country_id: 6252001
description:
[2025-12-31 19:57:27 +0530] info [cpaneld] 98.114.136.17 - millenni "GET /login/?login_only=1&user=millenni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenni (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 19:59:14 host2 sshd[1537604]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 20:01:23 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<KIGFVEBHpJEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.3
country_id: 732800
description:
Dec 31 20:02:50 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.255.212.3, lip=66.85.158.91, TLS, session=<+WjBWEBH7Om5/9QD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.107
country_id: 3865483
description:
Dec 31 20:03:11 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.11.195.107, lip=66.85.158.91, TLS, session=<eJjrWUBHOsK+C8Nr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Dec 31 20:05:38 host2 sshd[1545585]: Disconnected from invalid user sammy 181.212.34.236 port 33470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Dec 31 20:05:46 host2 sshd[1545741]: Disconnected from invalid user test 151.243.213.125 port 53956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.34.236
country_id: 3895114
description:
Dec 31 20:06:59 host2 sshd[1547030]: Disconnected from invalid user fts 181.212.34.236 port 42054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 20:06:19 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<VV0qZkBHbt8zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Dec 31 20:06:54 host2 sshd[1546910]: Disconnected from invalid user oracle 151.243.213.125 port 44194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 20:06:58 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<UPlraEBHnTxniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Dec 31 20:07:43 host2 sshd[1547758]: Disconnected from invalid user alien 181.212.34.236 port 47470 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 20:07:09 host2 pure-ftpd[1547244]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Dec 31 20:07:28 host2 sshd[1547532]: Disconnected from invalid user syp 151.243.213.125 port 35500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Dec 31 20:08:23 host2 sshd[1548458]: Disconnected from invalid user ying 181.212.34.236 port 36302 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.245
country_id: 6252001
description:
Dec 31 20:08:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.245, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<obBObkBHVcii2JX1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.243.213.125
country_id: 290557
description:
Dec 31 20:08:36 host2 sshd[1548670]: Disconnected from invalid user raja 151.243.213.125 port 56352 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.245
country_id: 6252001
description:
Dec 31 20:09:21 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.245, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<I/kfcUBHnOWi2JX1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-31 20:09:28 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (ownspurper) [68.40.189.43]:43740: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 20:10:08 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<xQHGc0BHCoCYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 31 20:14:36 host2 sshd[1555791]: Disconnected from invalid user marcela 35.216.63.127 port 64724 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.193.177.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.193.177.237 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.239.206.199
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.239.206.199 - essenceceylonteacom "GET /login/?login_only=1&user=essenceceylonteacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylonteacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.137.80.143
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.137.80.143 - essence1 "GET /login/?login_only=1&user=essence1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.209.189.103
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.209.189.103 - essenceceylontea "GET /login/?login_only=1&user=essenceceylontea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User essenceceylontea has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.110.235.186
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 208.110.235.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.55.114.137
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.55.114.137 - essenc "GET /login/?login_only=1&user=essenc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.117.158
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 184.164.117.158 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.245
country_id: 6252001
description:
Dec 31 20:15:52 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.245, lip=66.85.158.92, TLS, session=<4cRtiEBHzOai2JX1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.251.123.2
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.251.123.2 - ess "GET /login/?login_only=1&user=ess&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ess (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.142.96.30
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.142.96.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.63.16.176
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.63.16.176 - essence "GET /login/?login_only=1&user=essence&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.222.175.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.222.175.88 - essencec "GET /login/?login_only=1&user=essencec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.130.252.182
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.130.252.182 - essen "GET /login/?login_only=1&user=essen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.45.34.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.45.34.16 - esse "GET /login/?login_only=1&user=esse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.220.100.243
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.220.100.243 - essence2 "GET /login/?login_only=1&user=essence2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 31 20:15:09 host2 sshd[1556575]: Disconnected from invalid user demo 209.141.47.217 port 45880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 20:16:27 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<gSdlikBHAIcv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.245
country_id: 6252001
description:
Dec 31 20:16:11 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.245, lip=66.85.158.92, TLS, session=<gHuNiUBHGP+i2JX1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 31 20:18:06 host2 sshd[1560351]: Disconnected from invalid user devuser 103.255.147.244 port 49284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.145
country_id: 241170
description:
Dec 31 20:17:28 host2 sshd[1559551]: Disconnected from invalid user henry 212.11.64.145 port 48176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 31 20:17:31 host2 sshd[1559594]: Disconnected from invalid user bitrix 154.91.81.224 port 60244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 20:17:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<29xWjkBHjKMyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 31 20:17:53 host2 sshd[1560050]: Disconnected from invalid user vmuser 104.248.245.89 port 33944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Dec 31 20:18:25 host2 sshd[1560664]: Disconnected from invalid user anna 64.227.131.199 port 54084 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 31 20:18:11 host2 sshd[1560408]: Disconnected from invalid user testuser 154.91.81.224 port 44456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 20:19:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+ebllUBHS89100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 31 20:19:56 host2 sshd[1562237]: Disconnected from invalid user admin 104.248.245.89 port 55348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 31 20:20:05 host2 sshd[1562576]: Disconnected from invalid user ftpadmin 209.141.47.217 port 51362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 31 20:20:09 host2 sshd[1562607]: Disconnected from invalid user debian 154.91.81.224 port 52740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Dec 31 20:20:22 host2 sshd[1562885]: Disconnected from invalid user fivem 64.227.131.199 port 48288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 31 20:21:15 host2 sshd[1563883]: Disconnected from invalid user gmodserver 209.141.47.217 port 36476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 31 20:21:32 host2 sshd[1564167]: Disconnected from invalid user virt 154.91.81.224 port 48780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 31 20:21:38 host2 sshd[1564355]: Disconnected from invalid user noc 35.216.63.127 port 55136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 20:21:09 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<3ZEzm0BHhp6eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 31 20:22:38 host2 sshd[1565655]: Disconnected from invalid user anna 103.255.147.244 port 34952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Dec 31 20:22:40 host2 sshd[1565723]: Disconnected from invalid user ubuntu 152.53.184.147 port 59534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Dec 31 20:22:51 host2 sshd[1565947]: Disconnected from invalid user ubuntu 64.227.131.199 port 48110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.187
country_id: 1643084
description:
Dec 31 20:22:25 host2 sshd[1565439]: Disconnected from invalid user debian 103.59.95.187 port 51084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 20:23:54 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<upYHpUBHLq1CdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.193.223
country_id: 1643084
description:
Dec 31 20:23:10 host2 sshd[1566436]: Disconnected from invalid user l4d2server 103.139.193.223 port 57560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 31 20:23:15 host2 sshd[1566676]: Disconnected from invalid user anna 141.145.147.99 port 54404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Dec 31 20:23:23 host2 sshd[1566858]: Disconnected from invalid user ms 152.53.184.147 port 60226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 20:24:35 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<vid2p0BHzpqeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.145.147.99
country_id: 290557
description:
Dec 31 20:25:56 host2 sshd[1570175]: Disconnected from invalid user ubuntu 141.145.147.99 port 48264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 31 20:25:11 host2 sshd[1569253]: Disconnected from invalid user bot 141.145.147.99 port 55928 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 31 20:27:48 host2 dovecot[988630]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<pb8Ts0BHcNoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.206
country_id: 2635167
description:
Dec 31 20:27:54 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.206, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6uJts0BHh5q594nO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.200
country_id: 2635167
description:
Dec 31 20:27:53 host2 dovecot[988630]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.200, lip=66.85.158.91, TLS, session=<cV5is0BH+dq594nI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-31 20:28:45 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:53094: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.183
country_id: 2635167
description:
Dec 31 20:29:00 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.183, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<Ubxkt0BHo6BX7LC3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.182
country_id: 2635167
description:
Dec 31 20:28:27 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TS9ptUBH+dG594m2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-31 20:28:31 dovecot_login authenticator failed for H=([182.95.2.9]) [182.78.67.22]:35242: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 20:28:43 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<GSU9tkBHanojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.202
country_id: 2635167
description:
Dec 31 20:29:33 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.202, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<AO1fuUBH86RX7LDK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.216
country_id: 2635167
description:
Dec 31 20:30:07 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.216, lip=66.85.158.91, TLS handshaking: Connection closed, session=<60tbu0BHu5a594nY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.206
country_id: 2635167
description:
Dec 31 20:30:40 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.206, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4aZUvUBHR6u594nO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 31 20:30:46 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<ko61vUBHcssDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.196
country_id: 2635167
description:
Dec 31 20:31:13 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.196, lip=66.85.158.91, TLS handshaking: Connection closed, session=<h+5Rv0BHa95X7LDE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.208
country_id: 2635167
description:
Dec 31 20:31:46 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.208, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<mSxNwUBHqey594nQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.186
country_id: 2635167
description:
Dec 31 20:32:19 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.186, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<MIlGw0BHjdRX7LC6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.7
country_id: 2635167
description:
Dec 31 20:32:27 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.7, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<u6W0w0BHoNojy9MH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.207
country_id: 2635167
description:
Dec 31 20:32:53 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<vdRBxUBHwZq594nP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.7
country_id: 2635167
description:
Dec 31 20:33:24 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.7, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<1Xojx0BHNvojy9MH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 20:34:26 host2 sshd[1580703]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec 31 20:34:44 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, session=<kovhy0BHzPRKUi8E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec 31 20:35:11 host2 dovecot[988630]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, session=<IwN+zUBHMHBKUi8E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 20:37:58 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<h/NQ10BHeuueRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 20:38:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56000: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 20:38:57 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<SQvU2kBHoIAvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 20:39:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JB8y20BH9q5n9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.7
country_id: 2635167
description:
Dec 31 20:39:14 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.7, lip=66.85.158.91, TLS, session=<GIT820BHNu0jy9MH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 20:40:09 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rtIl30BHQqSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 20:42:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<4rpR50BHVtaeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.123.65.63
country_id: 1168579
description:
Dec 31 20:42:40 host2 sshd[1594240]: Disconnected from invalid user devuser 223.123.65.63 port 60264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 20:44:02 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<9z0P7UBHAJwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:45:12 host2 sshd[1598042]: Disconnected from invalid user ubuntu 162.19.243.145 port 50178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 31 20:46:11 host2 sshd[1599123]: Disconnected from invalid user fivem 141.145.147.99 port 47258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:47:55 host2 sshd[1601425]: Disconnected from invalid user user 162.19.243.145 port 47780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.199.44.215
country_id: 2750405
description:
Dec 31 20:48:24 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=128.199.44.215, lip=66.85.158.92, session=<bc3K/EBHpLqAxyzX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:48:52 host2 sshd[1602777]: Disconnected from invalid user test4 162.19.243.145 port 57286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 31 20:49:49 host2 sshd[1603918]: Disconnected from invalid user deploy 190.0.63.226 port 44690 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:49:55 host2 sshd[1603998]: Received disconnect from 162.19.243.145 port 43358:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 20:50:22 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vLysA0FHNMxnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-31 20:50:23 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (deheline) [98.40.101.10]:35852: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 20:51:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<5259B0FHNIsFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 31 20:51:48 host2 sshd[1606368]: Disconnected from invalid user myuser 103.113.105.228 port 49191 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:52:12 host2 sshd[1606881]: Disconnected from invalid user ubuntu 186.64.123.41 port 47541 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 31 20:52:19 host2 sshd[1607035]: Disconnected from invalid user smart 190.0.63.226 port 35162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Dec 31 20:52:47 host2 sshd[1607497]: Disconnected from invalid user ubuntu 41.33.91.226 port 36686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 20:53:08 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<YniZDUFHZC2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 31 20:53:14 host2 sshd[1608007]: Disconnected from invalid user user 154.124.97.102 port 33412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:53:21 host2 sshd[1608119]: Disconnected from invalid user ubuntu 162.19.243.145 port 46254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:55:34 host2 sshd[1611359]: Disconnected from invalid user jack 186.64.123.41 port 43395 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Dec 31 20:56:09 host2 sshd[1612013]: Disconnected from invalid user rsync 181.64.27.145 port 52172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:56:17 host2 sshd[1612170]: Disconnected from invalid user iksi 186.64.123.41 port 49433 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:57:00 host2 sshd[1612965]: Disconnected from invalid user myuser 186.64.123.41 port 55473 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:57:44 host2 sshd[1613887]: Disconnected from invalid user casa 186.64.123.41 port 33279 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 31 20:58:20 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<5udOIEFHtueLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Dec 31 20:58:44 host2 sshd[1614971]: Disconnected from invalid user admin1 41.33.91.226 port 45708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-31 20:58:55 dovecot_plain authenticator failed for H=(inges) [91.73.188.251]:39962: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Dec 31 20:58:28 host2 sshd[1614702]: Disconnected from invalid user myuser 181.64.27.145 port 53942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 31 20:59:38 host2 sshd[1616054]: Disconnected from invalid user jack 103.113.105.228 port 47746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Dec 31 20:59:12 host2 sshd[1615539]: Disconnected from invalid user sftpuser 181.64.27.145 port 47654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Dec 31 21:00:35 host2 sshd[1617593]: Disconnected from invalid user admin1 181.64.27.145 port 40176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Dec 31 21:00:41 host2 sshd[1617701]: Disconnected from invalid user me 41.33.91.226 port 46664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 31 21:00:58 host2 sshd[1618054]: Disconnected from invalid user pmf 103.113.105.228 port 53813 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 31 21:00:18 host2 sshd[1617185]: Disconnected from invalid user arjun 154.124.97.102 port 32789 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.104.30.66
country_id: 6252001
description:
Dec 31 21:01:56 host2 pure-ftpd[1619482]: (?@172.104.30.66) [INFO] New connection from 172.104.30.66


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 21:01:59 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<67IzLUFHyHto7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.30.66
country_id: 6252001
description:
Dec 31 21:01:46 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.104.30.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RA6PLEFHxLysaB5C>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 31 21:02:15 host2 sshd[1619875]: Disconnected from invalid user server 103.113.105.228 port 59785 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 21:03:13 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<srWfMUFH7hpniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-31 21:03:24 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (nonicong) [68.52.119.193]:46184: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 31 21:03:30 host2 sshd[1621677]: Disconnected from invalid user test 154.124.97.102 port 51576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 21:03:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HxkoNEFHgrQv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 31 21:06:47 host2 sshd[1625859]: Disconnected from invalid user ronaldo 154.124.97.102 port 38750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 31 21:09:00 host2 sshd[1628415]: Disconnected from invalid user postgres 181.46.131.55 port 36168 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 21:10:03 host2 sshd[1629965]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 21:10:47 host2 sshd[1631032]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 21:10:47 host2 pure-ftpd[1631044]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 21:12:05 host2 sshd[1632743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 21:18:00 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<LniEZkFHeJIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 21:21:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<UIc1c0FHUKeeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.235
country_id: 6252001
description:
Dec 31 21:27:22 host2 pure-ftpd[1653178]: (?@198.235.24.235) [INFO] New connection from 198.235.24.235


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 21:27:29 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<q9lpiEFHPtQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 21:27:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vcsGikFHRM4v/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.211.126.21
country_id: 6252001
description:
Dec 31 21:29:38 host2 pure-ftpd[1655602]: (?@130.211.126.21) [INFO] New connection from 130.211.126.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-31 21:30:47 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:60644: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-31 21:31:24 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:38480: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-31 21:32:13 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (catale) [71.235.225.181]:57310: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 21:32:42 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<y74Lm0FHQNtCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 21:34:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<R4Tun0FH/uAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 21:37:37 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<4OmhrEFHxMtn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.236.131
country_id: 614540
description:
Dec 31 21:38:27 host2 pure-ftpd[1666688]: (?@95.181.236.131) [INFO] New connection from 95.181.236.131


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.124.158
country_id: 3042225
description:
Dec 31 21:38:27 host2 pure-ftpd[1666683]: (?@91.90.124.158) [INFO] New connection from 91.90.124.158


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 21:38:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<jPoRsEFHSKyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 21:39:23 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ncn1skFHAI+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.137
country_id: 3175395
description:
Dec 31 21:39:57 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.15.169.137, lip=66.85.158.91, TLS, session=<B5gGtEFH1di5D6mJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.117.177
country_id: 3469034
description:
Dec 31 21:40:24 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=177.87.117.177, lip=66.85.158.91, TLS, session=<v+yZtUFH5cOxV3Wx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 21:42:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<6TtAv0FHJJWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 21:42:57 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0gu4v0FHbHcjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 21:43:21 host2 sshd[1672873]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.231.254
country_id: 2750405
description:
Dec 31 21:46:08 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.231.254, lip=66.85.158.91, session=<ojg/y0FH8uif3+f+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 21:48:57 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<hZUu1UFHauZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-12-31 21:51:31 dovecot_plain authenticator failed for H=(fordial) [87.121.76.190]:34520: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-31 21:51:43 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (ulachodef) [73.13.220.220]:41094: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 21:53:59 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<kL4w50FHYDWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 21:57:57 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yakl9UFHfkdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 21:59:10 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<foe3+UFHMokvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 22:01:32 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<WR0xAkJHkNqeRdGr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.7
country_id: 2328926
description:
Dec 31 22:02:10 host2 pure-ftpd[1707862]: (?@102.204.223.7) [INFO] New connection from 102.204.223.7


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 22:07:04 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ficBFkJHU1N100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 22:10:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<8dBoI0JHlDlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 22:10:52 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Y9mMI0JHGJ8FhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-31 22:12:52 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (chorlinia) [73.208.81.125]:36284: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 22:13:35 host2 pure-ftpd[1721641]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 22:15:55 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<hzOlNUJHutAv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.185
country_id: 6252001
description:
Dec 31 22:16:29 host2 pure-ftpd[1725103]: (?@198.235.24.185) [INFO] New connection from 198.235.24.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.94
country_id: 2542007
description:
2025-12-31 22:17:38 dovecot_login authenticator failed for H=([105.73.190.94]) [105.73.190.94]:37855: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.149
country_id: 1733045
description:
2025-12-31 22:18:08 dovecot_login authenticator failed for H=([49.124.152.149]) [49.124.152.149]:40950: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 22:18:30 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<EjDjPkJHxLaeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 22:19:21 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<BH/nQUJHXp+eRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec 31 22:19:25 host2 pure-ftpd[1728613]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 31 22:20:42 host2 sshd[1730342]: Disconnected from invalid user nextcloud 8.243.50.114 port 39910 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.218.248.146
country_id: 6252001
description:
Dec 31 22:24:37 host2 pure-ftpd[1734788]: (?@13.218.248.146) [INFO] New connection from 13.218.248.146


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 22:25:20 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<q0BIV0JH4IAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 22:27:14 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<I+wTXkJHVmIjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 31 22:26:40 host2 sshd[1737167]: Disconnected from invalid user developer 8.243.50.114 port 35670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 31 22:29:14 host2 sshd[1740377]: Disconnected from invalid user abc 8.243.50.114 port 54844 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 22:30:19 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Q7kfaUJHxtMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 22:35:35 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<mWfye0JH8oRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 22:36:28 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<o9oLf0JHZs6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 22:37:23 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<W2dggkJHMoCeRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - gnetuniv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniv (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 22:39:58 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<FQ6oi0JHCqAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 22:41:52 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<uEtvkkJHzN1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 22:42:51 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<1qX3lUJHNpwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.117
country_id: 1269750
description:
Dec 31 22:43:33 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.18.166.117, lip=66.85.158.91, TLS, session=<sWcyl0JHHrFnEqZ1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.79
country_id: 2510769
description:
Dec 31 22:43:50 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=46.39.212.79, lip=66.85.158.91, TLS, session=<CmmjmEJHma8uJ9RP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 22:47:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7Xi0p0JHvtxnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-12-31 22:51:48 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:35972: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-31 22:51:18 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:32826: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 22:52:18 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<xCrBt0JH/pMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 22:52:23 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4rkHuEJHzClniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-31 22:53:47 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:51216: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 22:54:06 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<UkAsvkJH+G6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-31 22:53:28 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:34288: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Dec 31 22:55:14 host2 sshd[1771141]: Disconnected from invalid user rich 178.62.25.91 port 49132 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 22:56:59 host2 sshd[1773392]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 31 22:57:05 host2 sshd[1773523]: Disconnected from invalid user peter 189.194.140.170 port 38206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2025-12-31 22:57:15 dovecot_login authenticator failed for H=(nsg-static-233.166.76.182-airtel.com) [182.95.125.122]:39526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Dec 31 22:56:21 host2 sshd[1772699]: Disconnected from invalid user data 81.234.146.158 port 44804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.210
country_id: 6252001
description:
Dec 31 22:56:36 host2 sshd[1772992]: Disconnected from invalid user mailuser 203.161.56.210 port 43092 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.234.146.158
country_id: 2661886
description:
Dec 31 22:57:55 host2 sshd[1774378]: Disconnected from invalid user hadoop 81.234.146.158 port 59120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-31 22:58:02 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:48824: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Dec 31 22:59:03 host2 sshd[1775614]: Disconnected from invalid user rich 52.224.109.126 port 52180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.210
country_id: 6252001
description:
Dec 31 22:59:26 host2 sshd[1776108]: Disconnected from invalid user me 203.161.56.210 port 34496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Dec 31 23:00:03 host2 sshd[1776965]: Disconnected from invalid user traccar 81.234.146.158 port 54414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.98.248
country_id: 6252001
description:
Dec 31 23:00:21 host2 sshd[1777474]: Disconnected from invalid user odoo 144.172.98.248 port 43576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 31 23:00:22 host2 sshd[1777478]: Disconnected from invalid user debian 189.194.140.170 port 48160 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.161.56.210
country_id: 6252001
description:
Dec 31 23:00:29 host2 sshd[1777596]: Disconnected from invalid user traccar 203.161.56.210 port 48384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Dec 31 23:00:35 host2 sshd[1777706]: Disconnected from invalid user test1 81.234.146.158 port 60295 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Dec 31 23:01:35 host2 sshd[1779061]: Disconnected from invalid user sftpuser 103.189.235.176 port 40656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 31 23:01:41 host2 sshd[1779234]: Disconnected from invalid user alice 189.194.140.170 port 47324 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.172.98.248
country_id: 6252001
description:
Dec 31 23:01:59 host2 sshd[1779581]: Disconnected from invalid user kenji 144.172.98.248 port 37918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 23:01:21 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<oQMa2EJHzol100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.98.248
country_id: 6252001
description:
Dec 31 23:01:27 host2 sshd[1778869]: Disconnected from invalid user traccar 144.172.98.248 port 38502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Dec 31 23:02:38 host2 sshd[1780370]: Disconnected from invalid user justin 52.224.109.126 port 32860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Dec 31 23:02:44 host2 sshd[1780482]: Disconnected from invalid user low 178.62.25.91 port 39670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Dec 31 23:02:18 host2 sshd[1779922]: Disconnected from invalid user appuser 103.189.235.176 port 55112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.235.176
country_id: 1643084
description:
Dec 31 23:03:35 host2 sshd[1781674]: Disconnected from invalid user ubuntu 103.189.235.176 port 56136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.145.136
country_id: 1269750
description:
2025-12-31 23:05:08 dovecot_login authenticator failed for H=(nsg-corporate-136.145.180.122.airtel.in) [122.180.145.136]:46500: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-12-31 23:05:24 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [217.29.30.135]:42806: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-12-31 23:07:18 dovecot_plain authenticator failed for H=(prenest) [76.190.155.43]:47041: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 23:16:33 host2 pure-ftpd[1797841]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 23:17:27 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<7tGqEUNHnK2YNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-31 23:17:31 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:38680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-31 23:17:47 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:47992: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 23:17:21 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<fj1UEUNHGMGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 23:19:56 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<h1GVGkNH4G5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 23:20:36 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<gX3kHENHBJQvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-12-31 23:20:57 dovecot_login authenticator failed for H=([125.215.199.37]) [125.215.199.37]:52528: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-12-31 23:22:05 dovecot_login authenticator failed for H=([196.216.220.210]) [196.216.220.210]:49854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.65
country_id: 1880251
description:
Dec 31 23:21:17 host2 sshd[1804418]: Disconnected from invalid user surya 45.78.202.65 port 56306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.188
country_id: 1733045
description:
2025-12-31 23:21:39 dovecot_login authenticator failed for H=([49.124.148.188]) [49.124.148.188]:48794: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-31 23:21:46 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:54316: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 31 23:23:11 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<2hJWJkNHgsNChJl9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 31 23:25:33 host2 sshd[1809593]: Disconnected from invalid user ec2-user 45.78.223.75 port 42364 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 23:26:38 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iKWGMkNHGjwjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[15386] [Authentication Database]=[mail] [Username]=[postfix@anandaobauae.org] (12/10 failures) (blocked until [Thu Jan  1 17:56:36 2026 UTC/Thu Jan  1 23:26:36 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Dec 31 23:27:41 host2 sshd[1812248]: Disconnected from invalid user ec2-user 181.188.176.242 port 48498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.99.151
country_id: 2921044
description:
Dec 31 23:27:45 host2 sshd[1812347]: Disconnected from invalid user user5 64.225.99.151 port 50592 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 23:27:58 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<OBhLN0NHvMsv/AU1>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[52156] [Authentication Database]=[mail] [Username]=[info@lankaherbalsolutions.com] (10/10 failures) (blocked until [Thu Jan  1 17:57:56 2026 UTC/Thu Jan  1 23:27:56 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Dec 31 23:27:14 host2 sshd[1811689]: Disconnected from invalid user miner 64.225.99.151 port 58180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.156.114.92
country_id: 2921044
description:
Dec 31 23:27:30 host2 sshd[1811994]: Disconnected from invalid user a 94.156.114.92 port 45502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Dec 31 23:28:25 host2 sshd[1813140]: Disconnected from invalid user omm 181.188.176.242 port 41862 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 23:29:12 host2 sshd[1814256]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.103.210
country_id: 6252001
description:
Dec 31 23:29:28 host2 sshd[1814598]: Disconnected from invalid user kali 107.150.103.210 port 6928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.103.210
country_id: 6252001
description:
Dec 31 23:29:59 host2 sshd[1815198]: Disconnected from invalid user ansible 107.150.103.210 port 38262 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 23:30:14 host2 sshd[1815663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.103.210
country_id: 6252001
description:
Dec 31 23:31:04 host2 sshd[1816821]: Disconnected from invalid user bob 107.150.103.210 port 5686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 31 23:31:59 host2 sshd[1817865]: Disconnected from invalid user surya 45.78.223.75 port 49976 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 94.156.114.92
country_id: 2921044
description:
Dec 31 23:31:30 host2 sshd[1817307]: Received disconnect from 94.156.114.92 port 58120:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 23:31:36 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=</2pIRENH/rQFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Dec 31 23:31:51 host2 sshd[1817704]: Disconnected from invalid user wk 181.188.176.242 port 45290 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 23:32:11 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<941jRkNHAtNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 23:33:44 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<5VDqS0NHfpmi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-31 23:34:31 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (sliatia) [75.74.211.27]:38747: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 23:35:22 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<nvbIUUNHwoWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 23:38:37 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<qApoXUNH6tszTcpt>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[56298] [Authentication Database]=[mail] [Username]=[admin@lankaherbalsolutions.com] (10/10 failures) (blocked until [Thu Jan  1 18:08:35 2026 UTC/Thu Jan  1 23:38:35 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.182.15
country_id: 2017370
description:
Dec 31 23:39:03 host2 sshd[1827262]: Disconnected from invalid user mine 45.151.182.15 port 56250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.182.15
country_id: 2017370
description:
Dec 31 23:40:10 host2 sshd[1828690]: Disconnected from invalid user testuser 45.151.182.15 port 38998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 31 23:40:20 host2 sshd[1828938]: Disconnected from invalid user user 45.221.74.234 port 50524 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.151.182.15
country_id: 2017370
description:
Dec 31 23:40:46 host2 sshd[1829469]: Disconnected from invalid user tester 45.151.182.15 port 46410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 23:42:12 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jHg0akNHit0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Dec 31 23:42:19 host2 dovecot[1667607]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=85.217.149.1, lip=66.85.158.92, TLS, session=<YR29akNH4IBV2ZUB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.182.15
country_id: 2017370
description:
Dec 31 23:42:52 host2 sshd[1832154]: Disconnected from invalid user elasticsearch 45.151.182.15 port 45218 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 23:43:17 host2 sshd[1832795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 31 23:43:17 host2 sshd[1832743]: Disconnected from invalid user elasticsearch 45.221.74.234 port 32808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 23:43:41 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<tiSHb0NHdswzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 23:43:39 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<mGdnb0NHONCeRdGr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.221.74.234
country_id: 226074
description:
Dec 31 23:44:41 host2 sshd[1834655]: Disconnected from invalid user user5 45.221.74.234 port 33468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 23:45:29 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YJX0dUNHHQlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 23:46:38 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<GsIPekNHBJ9nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-31 23:49:11 dovecot_login authenticator failed for H=(128.102.88.80.sta.ac-net.se) [80.88.102.128]:39072: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2025-12-31 23:49:40 dovecot_login authenticator failed for H=([177.236.145.94]) [177.236.145.94]:49290: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 23:50:20 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<R0VMh0NHgqhCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 31 23:50:37 host2 sshd[1842903]: Disconnected from invalid user bob 45.78.223.75 port 58264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 31 23:51:43 host2 sshd[1844147]: Disconnected from invalid user panel 45.78.223.75 port 54672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 23:52:20 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<5S1wjkNHVJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 23:52:31 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<LZwdj0NH3ICi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.92
country_id: 2510769
description:
Dec 31 23:53:16 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.229.98.92, lip=66.85.158.91, TLS, session=<HrjukENHWpq55WJc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.159.85
country_id: 690791
description:
Dec 31 23:53:34 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.159.85, lip=66.85.158.91, TLS, session=<ouwCkkNHg7ol3Z9V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 23:55:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kBLomkNHXN1100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 00:00:30 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<LyGpq0NH3I6eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Jan  1 00:00:37 host2 sshd[1855403]: Disconnected from invalid user user 201.124.168.139 port 52862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.246.87.238
country_id: 3658394
description:
Jan  1 00:00:48 host2 sshd[1855682]: Disconnected from invalid user ec2-user 170.246.87.238 port 35330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.59.208
country_id: 1168579
description:
Jan  1 00:00:52 host2 sshd[1855716]: Disconnected from invalid user runner 182.180.59.208 port 38146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Jan  1 00:00:55 host2 sshd[1855932]: Disconnected from invalid user public 103.172.205.103 port 58250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Jan  1 00:01:32 host2 sshd[1856738]: Disconnected from invalid user webserver 177.53.215.134 port 39480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Jan  1 00:02:39 host2 sshd[1858033]: Disconnected from invalid user deploy 177.53.215.134 port 56552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.8
country_id: 1880251
description:
Jan  1 00:02:45 host2 sshd[1858152]: Disconnected from invalid user omm 45.78.221.8 port 56244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  1 00:02:48 host2 sshd[1858241]: Disconnected from invalid user ec2-user 139.59.64.179 port 48188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Jan  1 00:02:55 host2 sshd[1858397]: Disconnected from invalid user certbot 201.124.168.139 port 60180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.59.208
country_id: 1168579
description:
Jan  1 00:02:58 host2 sshd[1858376]: Disconnected from invalid user demo 182.180.59.208 port 37716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Jan  1 00:03:56 host2 sshd[1859924]: Disconnected from invalid user no-reply 177.53.215.134 port 51860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  1 00:05:06 host2 sshd[1861532]: Disconnected from invalid user runner 50.225.176.238 port 49374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  1 00:06:02 host2 sshd[1862891]: Disconnected from invalid user omm 139.59.64.179 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.180.59.208
country_id: 1168579
description:
Jan  1 00:06:01 host2 sshd[1862851]: Disconnected from invalid user ops 182.180.59.208 port 34242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Jan  1 00:05:09 host2 sshd[1861595]: Disconnected from invalid user zac 201.124.168.139 port 50572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  1 00:06:16 host2 sshd[1863179]: Disconnected from invalid user kafka 161.132.19.77 port 57422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  1 00:06:29 host2 sshd[1863456]: Disconnected from invalid user orlando 78.135.111.5 port 42428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  1 00:06:37 host2 sshd[1863742]: Disconnected from invalid user deploy 139.59.64.179 port 44898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.101.12
country_id: 1269750
description:
Jan  1 00:06:57 host2 sshd[1864151]: Disconnected from invalid user kafka 157.245.101.12 port 46684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  1 00:06:59 host2 sshd[1864208]: Disconnected from invalid user pro 85.18.236.229 port 45748 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  1 00:07:11 host2 sshd[1864540]: Disconnected from invalid user user 139.59.64.179 port 58458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  1 00:07:25 host2 sshd[1864840]: Disconnected from invalid user soporte 50.225.176.238 port 37912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.246.87.238
country_id: 3658394
description:
Jan  1 00:07:35 host2 sshd[1865017]: Disconnected from invalid user no-reply 170.246.87.238 port 35970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  1 00:07:29 host2 sshd[1864898]: Disconnected from invalid user backups 85.18.236.229 port 57252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  1 00:07:31 host2 sshd[1864941]: Disconnected from invalid user hadoop 161.132.19.77 port 56572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Jan  1 00:08:32 host2 sshd[1866307]: Disconnected from invalid user mas 103.172.205.103 port 47348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  1 00:08:34 host2 sshd[1866341]: Disconnected from invalid user sanjay 78.135.111.5 port 33910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.246.87.238
country_id: 3658394
description:
Jan  1 00:08:09 host2 sshd[1865816]: Disconnected from invalid user vncuser 170.246.87.238 port 46816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  1 00:08:21 host2 sshd[1866086]: Disconnected from invalid user installer 50.225.176.238 port 42690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Jan  1 00:08:23 host2 sshd[1866102]: Disconnected from invalid user trading 45.78.226.12 port 59894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  1 00:08:25 host2 sshd[1866167]: Disconnected from invalid user db2admin 85.18.236.229 port 51962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 00:09:34 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55378: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  1 00:10:30 host2 sshd[1868799]: Disconnected from invalid user no-reply 161.132.19.77 port 60532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 00:10:18 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hoS3zkNHTJoyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  1 00:10:21 host2 sshd[1868635]: Disconnected from invalid user developer 23.95.132.54 port 46834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Jan  1 00:11:37 host2 sshd[1870020]: Disconnected from invalid user cuckoo 103.172.205.103 port 50094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  1 00:11:47 host2 sshd[1870213]: Disconnected from invalid user vikas 23.95.132.54 port 53326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Jan  1 00:12:23 host2 sshd[1871003]: Disconnected from invalid user test1 103.172.205.103 port 55100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.101.12
country_id: 1269750
description:
Jan  1 00:13:01 host2 sshd[1871660]: Disconnected from invalid user sinusbot 157.245.101.12 port 59752 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Jan  1 00:13:15 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Hh9h2UNH4n5ChJmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 00:15:03 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<JyCw30NH5LSeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.12
country_id: 1880251
description:
Jan  1 00:16:47 host2 sshd[1876016]: Disconnected from invalid user intell 45.78.226.12 port 53442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.8
country_id: 1880251
description:
Jan  1 00:18:12 host2 sshd[1877733]: Disconnected from invalid user user 45.78.221.8 port 43850 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 00:19:19 host2 pure-ftpd[1879013]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.230
country_id: 6252001
description:
Jan  1 00:21:29 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS: Connection closed, session=<oIjW9kNHTI9HBobm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.79
country_id: 6252001
description:
Jan  1 00:23:52 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.79, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ndRd/0NHnMKTuYRP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-01 00:24:26 dovecot_plain authenticator failed for H=(hebown) [76.190.155.43]:34075: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-01 00:24:43 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (ormant) [73.176.157.57]:37524: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.122.203.39
country_id: 1819730
description:
Jan  1 00:25:59 host2 sshd[1889788]: Disconnecting invalid user admin 223.122.203.39 port 43092: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 00:26:01 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<c7XqBkRH7OojupN+>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 223.122.203.39
country_id: 1819730
description:
Jan  1 00:25:46 host2 sshd[1889299]: Disconnecting authenticating user root 223.122.203.39 port 33522: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 223.122.203.39
country_id: 1819730
description:
Jan  1 00:25:46 host2 sshd[1889299]: error: maximum authentication attempts exceeded for root from 223.122.203.39 port 33522 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.122.203.39
country_id: 1819730
description:
Jan  1 00:25:56 host2 sshd[1889667]: error: maximum authentication attempts exceeded for invalid user admin from 223.122.203.39 port 35416 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 00:26:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<gXTFCURHkiBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 00:28:04 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<fgtCDkRH+KBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-01 00:28:25 dovecot_plain authenticator failed for H=(arymy) [12.150.243.22]:54261: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-01 00:28:30 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (mendyne) [76.145.10.140]:50118: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 00:30:23 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rSCMFkRHqK6i8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan  1 00:30:41 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0OO5F0RHGiG4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan  1 00:31:15 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS: Connection closed, session=<a9HDGURHrPS4aYtG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 00:33:15 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<r6TDIERHuqKeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.95.121.178
country_id: 3175395
description:
Jan  1 00:34:43 host2 sshd[1905013]: Disconnected from invalid user alice 5.95.121.178 port 57484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan  1 00:35:43 host2 sshd[1906731]: Disconnected from invalid user rundeck 24.144.124.91 port 34056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.95.121.178
country_id: 3175395
description:
Jan  1 00:36:26 host2 sshd[1907646]: Disconnected from invalid user odoo 5.95.121.178 port 37156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.95.121.178
country_id: 3175395
description:
Jan  1 00:37:59 host2 sshd[1909690]: Disconnected from invalid user senthil 5.95.121.178 port 38646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan  1 00:38:08 host2 sshd[1909906]: Disconnected from invalid user ubuntu 24.144.124.91 port 35588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 00:38:47 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<d9yPNERHiBJniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.7
country_id: 1227603
description:
Jan  1 00:39:57 host2 dovecot[1911092]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=98.159.40.7, lip=66.85.158.91, session=<BergOERHUJdinygH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.28
country_id: 953987
description:
Jan  1 00:39:58 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.47.30.28, lip=66.85.158.91, TLS, session=<KPHrOERHcL6aLx4c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.47.194.4
country_id: 146669
description:
Jan  1 00:39:58 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=195.47.194.4, lip=66.85.158.91, session=<wmblOERH+nDDL8IE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.223.173.112
country_id: 2658434
description:
Jan  1 00:39:44 host2 pure-ftpd[1912075]: (?@176.223.173.112) [INFO] New connection from 176.223.173.112


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 00:40:22 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<LU87OkRHTsQv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-01 00:40:30 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (ormade) [71.230.228.16]:49230: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 00:41:42 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4x4AP0RHsscjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.54
country_id: 6252001
description:
Jan  1 00:41:47 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.54, lip=66.85.158.91, session=<futtP0RHDO7N0h82>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 00:41:56 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<TjfPP0RHup4vWBNS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 00:43:35 host2 sshd[1917329]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.144.124.91
country_id: 6252001
description:
Jan  1 00:44:07 host2 sshd[1918117]: Disconnected from invalid user leon 24.144.124.91 port 47428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 00:44:55 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<KvF3SkRH3Oxnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan  1 00:46:31 host2 sshd[1921864]: Disconnected from invalid user odoo 24.144.124.91 port 47572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 00:46:40 host2 sshd[1922031]: Disconnected from invalid user user 2.57.121.25 port 8108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 00:50:53 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<dmzYX0RH+G+i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 00:50:12 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Dz9eXURHcul100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 00:50:14 host2 sshd[1926320]: Disconnected from invalid user admin 2.57.121.112 port 53371 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 00:51:46 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<+qQBY0RHRN8zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:51:58 host2 sshd[1928519]: Disconnected from invalid user user 197.153.57.103 port 50543 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Jan  1 00:52:13 host2 sshd[1928827]: Disconnected from invalid user wordpress 35.240.75.51 port 49900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 00:52:20 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<8hEAZURH/IGYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Jan  1 00:52:40 host2 sshd[1929381]: Disconnected from invalid user user 24.232.50.5 port 46110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 00:52:50 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<oT/PZkRHpqoFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  1 00:53:30 host2 sshd[1930495]: Disconnected from invalid user testing 45.40.57.41 port 57744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:53:57 host2 sshd[1931000]: Disconnected from invalid user nvr 197.153.57.103 port 36802 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.198
country_id: 6252001
description:
Jan  1 00:54:06 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.198, lip=66.85.158.92, session=<OwN9a0RHmM6s7OTG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-01 00:54:53 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:46137: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  1 00:54:54 host2 sshd[1932571]: Disconnected from invalid user nvr 40.115.18.231 port 47884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.175.213.4
country_id: 6252001
description:
Jan  1 00:54:56 host2 dovecot[1911092]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.175.213.4, lip=66.85.158.92, session=<wyFwbkRHaINCr9UE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:54:35 host2 sshd[1932200]: Disconnected from invalid user teamspeak 197.153.57.103 port 43400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.71.115
country_id: 6252001
description:
Jan  1 00:55:57 host2 sshd[1934093]: Disconnected from invalid user david 52.224.71.115 port 47398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  1 00:56:00 host2 sshd[1934137]: Disconnected from invalid user user 40.115.18.231 port 47082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-01 00:55:22 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:45668: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  1 00:55:27 host2 sshd[1933374]: Disconnected from invalid user rw 40.115.18.231 port 33372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:55:43 host2 sshd[1933814]: Disconnected from invalid user ubuntu 197.153.57.103 port 56511 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 00:56:48 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<r/r8dERH/u0zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:56:16 host2 sshd[1934545]: Disconnected from invalid user hunter 197.153.57.103 port 34937 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.31
country_id: 1643084
description:
Jan  1 00:57:14 host2 sshd[1935412]: Disconnected from invalid user jorge 103.139.193.31 port 39798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  1 00:57:46 host2 sshd[1936067]: Disconnected from invalid user wordpress 40.115.18.231 port 60026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.136
country_id: 3469034
description:
Jan  1 00:57:44 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=177.92.247.136, lip=66.85.158.91, TLS, session=<KsNYd0RHcZSxXPeI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.13.110.39
country_id: 3865483
description:
Jan  1 00:57:13 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=181.13.110.39, lip=66.85.158.91, TLS, session=<tVpmdURH/YO1DW4n>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.71.115
country_id: 6252001
description:
Jan  1 00:57:36 host2 sshd[1935868]: Disconnected from invalid user steam 52.224.71.115 port 40692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 00:57:39 host2 sshd[1935915]: Disconnected from invalid user admin 103.59.95.177 port 36142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.78.253.49
country_id: 1210997
description:
2026-01-01 00:58:50 dovecot_plain authenticator failed for H=(B9MP3) [103.78.253.49]:11501: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 00:58:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<+VdOe0RHdOBCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.31
country_id: 1643084
description:
Jan  1 00:59:07 host2 sshd[1937667]: Disconnected from invalid user jenkins 103.139.193.31 port 37134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 00:58:43 host2 sshd[1937216]: Disconnected from invalid user jorge 103.59.95.177 port 37214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.18
country_id: 130758
description:
Jan  1 00:59:41 host2 sshd[1938259]: Disconnected from invalid user test001 109.122.251.18 port 32970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.193.31
country_id: 1643084
description:
Jan  1 00:59:51 host2 sshd[1938559]: Disconnected from invalid user user 103.139.193.31 port 46728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  1 01:00:30 host2 sshd[1939659]: Disconnected from invalid user admin 45.40.57.41 port 60192 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.167.53.36
country_id: 6252001
description:
Jan  1 01:01:03 host2 sshd[1940467]: Disconnected from invalid user rw 216.167.53.36 port 57542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.167.53.36
country_id: 6252001
description:
Jan  1 01:00:08 host2 sshd[1939165]: Disconnected from invalid user user 216.167.53.36 port 39216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Jan  1 01:00:32 host2 sshd[1939707]: Disconnected from invalid user appuser 35.240.75.51 port 33720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 01:00:45 host2 sshd[1940072]: Disconnected from invalid user ftpupload 103.59.95.177 port 49320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Jan  1 01:00:48 host2 sshd[1940128]: Disconnected from invalid user admin 24.232.50.5 port 55854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 01:01:17 host2 sshd[1940722]: Disconnected from invalid user sysadmin 103.59.95.177 port 48276 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 01:02:18 host2 sshd[1941873]: Received disconnect from 103.59.95.177 port 46918:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  1 01:02:51 host2 sshd[1942484]: Disconnected from invalid user teamspeak 45.40.57.41 port 49722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Jan  1 01:02:55 host2 sshd[1942610]: Disconnected from invalid user ftpupload 24.232.50.5 port 45310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  1 01:03:17 host2 sshd[1943241]: Disconnected from invalid user frappe 45.40.57.41 port 34130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.71.115
country_id: 6252001
description:
Jan  1 01:04:29 host2 sshd[1945189]: Disconnected from invalid user teamspeak 52.224.71.115 port 47270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 01:04:38 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<FyQJkURHkt0v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  1 01:04:19 host2 sshd[1944894]: Disconnected from invalid user sysadmin 185.221.216.189 port 53198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  1 01:05:27 host2 sshd[1946628]: Disconnected from invalid user ubuntu 2.83.107.150 port 57422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.86.68
country_id: 357994
description:
Jan  1 01:05:52 host2 sshd[1947266]: Disconnected from invalid user frappe 45.246.86.68 port 53650 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Jan  1 01:06:43 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=167.94.146.61, lip=66.85.158.91, TLS: Connection closed, session=<XmiVmERHFJynXpI9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  1 01:06:55 host2 sshd[1948861]: Disconnected from invalid user oracle 185.221.216.189 port 39426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  1 01:07:46 host2 sshd[1950070]: Disconnected from invalid user t 41.216.177.55 port 35384 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.235
country_id: 6252001
description:
Jan  1 01:07:52 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.235, lip=66.85.158.91, session=<GYuxnERHf9RBMQHr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.153.32.151
country_id: 798544
description:
Jan  1 01:07:52 host2 sshd[1950211]: Disconnected from invalid user minikube 185.153.32.151 port 42188 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  1 01:07:59 host2 sshd[1950374]: Disconnected from invalid user test 185.221.216.189 port 35468 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Jan  1 01:08:03 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, TLS: Connection closed, session=<iepSnURH+MpBMQHo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  1 01:07:32 host2 sshd[1949743]: Disconnected from invalid user user 2.83.107.150 port 63983 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Jan  1 01:08:05 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, session=<BSp8nURHROctT3OG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.132
country_id: 6252001
description:
Jan  1 01:07:38 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.132, lip=66.85.158.91, session=<dGzZm0RHvr1BMQGE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.212
country_id: 6252001
description:
Jan  1 01:07:43 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.212, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Ut0snERHcMjG6xjU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Jan  1 01:08:15 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<Ca8KnkRHII5BMQHo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  1 01:09:36 host2 sshd[1952759]: Disconnected from invalid user manager 2.83.107.150 port 50134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.92.110
country_id: 1643084
description:
Jan  1 01:09:43 host2 sshd[1952917]: Disconnected from invalid user wwww 103.191.92.110 port 51718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Jan  1 01:10:07 host2 sshd[1953606]: Disconnected from invalid user xh 103.193.178.248 port 52654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  1 01:09:27 host2 sshd[1952549]: Disconnected from invalid user username 185.221.216.189 port 43914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Jan  1 01:10:56 host2 sshd[1954843]: Disconnected from invalid user omar 103.193.178.248 port 54402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.92.110
country_id: 1643084
description:
Jan  1 01:10:49 host2 sshd[1954718]: Disconnected from invalid user t 103.191.92.110 port 47094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.191.92.110
country_id: 1643084
description:
Jan  1 01:11:26 host2 sshd[1955690]: Disconnected from invalid user xh 103.191.92.110 port 51794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Jan  1 01:11:37 host2 sshd[1955971]: Disconnected from invalid user sysadmin 103.193.178.248 port 45822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.86.68
country_id: 357994
description:
Jan  1 01:11:43 host2 sshd[1956102]: Disconnected from invalid user demo 45.246.86.68 port 46078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  1 01:11:12 host2 sshd[1955263]: Disconnected from invalid user bot 41.216.177.55 port 37042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.153.32.151
country_id: 798544
description:
Jan  1 01:11:23 host2 sshd[1955611]: Disconnected from invalid user demo 185.153.32.151 port 55800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.18
country_id: 130758
description:
Jan  1 01:11:26 host2 sshd[1955694]: Disconnected from invalid user sammy 109.122.251.18 port 47256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.246.86.68
country_id: 357994
description:
Jan  1 01:13:43 host2 sshd[1958832]: Disconnected from invalid user ftpuser 45.246.86.68 port 52510 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.60.12.168
country_id: 6252001
description:
Jan  1 01:13:59 host2 pure-ftpd[1959355]: (?@103.60.12.168) [INFO] New connection from 103.60.12.168


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.242
country_id: 1694008
description:
Jan  1 01:14:17 host2 sshd[1959730]: Disconnected from invalid user luis 103.18.229.242 port 41472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.86.68
country_id: 357994
description:
Jan  1 01:14:22 host2 sshd[1959835]: Disconnected from invalid user test 45.246.86.68 port 41370 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 01:16:31 host2 sshd[1962818]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 01:16:17 host2 sshd[1962512]: Disconnected from invalid user admin 2.57.121.112 port 36458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.3
country_id: 798549
description:
Jan  1 01:16:45 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.3, lip=66.85.158.91, TLS: Connection closed, session=<akd9vERHeopV2ZUD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.149
country_id: 6252001
description:
Jan  1 01:21:04 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.174.149, lip=66.85.158.92, session=</n3ky0RHAoIofK6V>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.161
country_id: 6252001
description:
Jan  1 01:20:10 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.161, lip=66.85.158.92, TLS handshaking: Connection closed, session=<a5quyERHtf9BMQGh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Jan  1 01:20:28 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FYy/yURHtsJBMQGY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 01:21:57 host2 pure-ftpd[1970265]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 798549
description:
Jan  1 01:22:17 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.91, TLS: Connection closed, session=<WqZF0ERHzJlV2ZUL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 01:24:12 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<SzP31kRHNJZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 01:26:07 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<BT7T3URH4M+i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 01:26:16 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<mD1k3kRHgmgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 01:26:47 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<scYz4ERHYpqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 01:29:56 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<v4+E60RH9KcyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 01:31:42 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<aVnS8URHAK+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 01:32:00 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yong8kRHBTtniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 01:38:07 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<4ITeCEVHKs7PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 01:37:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<KLXLBkVHPAto7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.231
country_id: 6252001
description:
Jan  1 01:37:46 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V8mZB0VHbNjN0h/n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 01:38:08 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<pWHyCEVHls7PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 01:42:09 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VLMuF0VHLOQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 01:43:55 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fDmGHUVHBoxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 01:44:32 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Pbe1H0VHlqmeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-01 01:44:18 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (proman) [73.213.237.28]:48388: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 01:44:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<7Q4xH0VHPsh100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Jan  1 01:45:31 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<J8pVI0VHABVBMQGi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.63
country_id: 6252001
description:
Jan  1 01:47:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+DAMLEVHqd+TuYQ/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.221.214
country_id: 1269750
description:
2026-01-01 01:49:03 dovecot_plain authenticator failed for H=(CHXEI8NX18) [157.48.221.214]:55657: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.221.214
country_id: 1269750
description:
2026-01-01 01:49:10 dovecot_login authenticator failed for H=(CHXEI8NX18) [157.48.221.214]:55657: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


