# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.245.116.235
country_id: 6252001
description:
[2025-11-14 14:32:01 +0530] info [cpaneld] 73.245.116.235 - visionsolutionshospital "GET /login/?login_only=1&user=visionsolutionshospital&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospital (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.57.252.163
country_id: 3865483
description:
[2025-11-14 14:32:08 +0530] info [whostmgrd] 186.57.252.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.204.144.15
country_id: 1269750
description:
[2025-11-14 14:32:15 +0530] info [cpaneld] 49.204.144.15 - visionsolutionshospitalcom "GET /login/?login_only=1&user=visionsolutionshospitalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospitalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.87.59
country_id: 1512440
description:
[2025-11-14 14:33:07 +0530] info [cpaneld] 213.230.87.59 - visionsolutio "GET /login/?login_only=1&user=visionsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.47.132.15
country_id: 1643084
description:
[2025-11-14 14:33:09 +0530] info [cpaneld] 103.47.132.15 - visionsoluti "GET /login/?login_only=1&user=visionsoluti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsoluti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.100.247.195
country_id: 102358
description:
[2025-11-14 14:33:17 +0530] info [cpaneld] 167.100.247.195 - visionsolut "GET /login/?login_only=1&user=visionsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.171
country_id: 3865483
description:
[2025-11-14 14:33:24 +0530] info [cpaneld] 181.46.164.171 - visionsolu "GET /login/?login_only=1&user=visionsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.107.172.13
country_id: 3895114
description:
[2025-11-14 14:32:37 +0530] info [cpaneld] 186.107.172.13 - visionsolutionshos "GET /login/?login_only=1&user=visionsolutionshos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.100.160
country_id: 6252001
description:
[2025-11-14 14:32:44 +0530] info [cpaneld] 35.151.100.160 - visionsolutionsh "GET /login/?login_only=1&user=visionsolutionsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.88.76
country_id: 99237
description:
[2025-11-14 14:32:52 +0530] info [cpaneld] 169.224.88.76 - visionsolutions "GET /login/?login_only=1&user=visionsolutions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.25.134.70
country_id: 3439705
description:
[2025-11-14 14:33:33 +0530] info [cpaneld] 179.25.134.70 - visionso "GET /login/?login_only=1&user=visionso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.18.98.245
country_id: 6252001
description:
[2025-11-14 14:32:43 +0530] info [cpaneld] 73.18.98.245 - visionsolutionsho "GET /login/?login_only=1&user=visionsolutionsho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionsho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.237.34.120
country_id: 3277605
description:
[2025-11-14 14:32:59 +0530] info [cpaneld] 109.237.34.120 - visionsolution "GET /login/?login_only=1&user=visionsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.143.12
country_id: 3469034
description:
[2025-11-14 14:33:26 +0530] info [cpaneld] 179.60.143.12 - visionsol "GET /login/?login_only=1&user=visionsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.153
country_id: 1694008
description:
2025-11-14 14:33:37 dovecot_login authenticator failed for (ADMIN) [188.214.125.153]:58078: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.115.176.75
country_id: 6252001
description:
[2025-11-14 14:34:16 +0530] info [cpaneld] 158.115.176.75 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.82.41.19
country_id: 6252001
description:
[2025-11-14 14:33:44 +0530] info [cpaneld] 71.82.41.19 - visions "GET /login/?login_only=1&user=visions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.192.239.195
country_id: 1269750
description:
[2025-11-14 14:34:02 +0530] info [cpaneld] 203.192.239.195 - vision "GET /login/?login_only=1&user=vision&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vision (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.91.218.245
country_id: 953987
description:
[2025-11-14 14:34:05 +0530] info [cpaneld] 197.91.218.245 - visio "GET /login/?login_only=1&user=visio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.124.142.126
country_id: 3865483
description:
[2025-11-14 14:34:12 +0530] info [cpaneld] 190.124.142.126 - visi "GET /login/?login_only=1&user=visi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.222.218.122
country_id: 1269750
description:
[2025-11-14 14:34:15 +0530] info [cpaneld] 106.222.218.122 - vis "GET /login/?login_only=1&user=vis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.18.153.28
country_id: 2017370
description:
[2025-11-14 14:34:18 +0530] info [cpaneld] 81.18.153.28 - visions1 "GET /login/?login_only=1&user=visions1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.81.128.239
country_id: 1835841
description:
[2025-11-14 14:34:35 +0530] info [cpaneld] 180.81.128.239 - visions2 "GET /login/?login_only=1&user=visions2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions2 (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 14 14:34:40 host2 sshd[3742200]: Disconnected from invalid user hadi 198.23.143.193 port 56608 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.226.33.124
country_id: 3865483
description:
Nov 14 14:38:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.226.33.124, lip=66.85.158.91, TLS, session=<nO1tV4pDCOG+4iF8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.153.240
country_id: 690791
description:
Nov 14 14:39:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=37.221.153.240, lip=66.85.158.91, TLS, session=<2MWyWIpD2ogl3Znw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 14 14:41:41 host2 sshd[3747288]: Disconnected from invalid user gituser 198.23.143.193 port 55656 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.29
country_id: 1819730
description:
Nov 14 14:46:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.29, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<odiCc4pD8nQtjpod>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.94
country_id: 1819730
description:
Nov 14 14:47:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.94, lip=66.85.158.91, TLS, session=<ohFgd4pDzuYtjppe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.45
country_id: 2802361
description:
2025-11-14 14:50:00 dovecot_login authenticator failed for (ADMIN) [181.214.218.45]:52007: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 15:00:34 host2 sshd[3761362]: Disconnected from invalid user admin 2.57.121.112 port 31293 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.125
country_id: 3469034
description:
Nov 14 15:02:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=191.37.11.125, lip=66.85.158.91, TLS, session=<E1xdrIpDZdy/JQt9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.170
country_id: 226074
description:
Nov 14 15:02:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=196.0.107.170, lip=66.85.158.91, TLS, session=<JH+0rYpDtJXEAGuq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 15:06:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49579: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-11-14 15:08:52 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:64368: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.110.3
country_id: 798544
description:
Nov 14 15:08:56 host2 sshd[3766635]: Disconnected from invalid user bitrix 83.168.110.3 port 47772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-14 15:08:58 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:56058: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-14 15:09:09 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:45130: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.215
country_id: 6252001
description:
Nov 14 15:09:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.215, lip=66.85.158.92, TLS, session=<oxLCx4pD7ujN0h/X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.77
country_id: 6252001
description:
Nov 14 15:11:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.155.77, lip=66.85.158.91, TLS: Connection closed, session=</3CdzIpDlN7HLZtN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.77
country_id: 6252001
description:
Nov 14 15:11:22 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=199.45.155.77, lip=66.85.158.91, session=</LvtzIpDcMjHLZtN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.118
country_id: 6252001
description:
2025-11-14 15:11:47 dovecot_login authenticator failed for (ADMIN) [212.32.49.118]:23391: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.110.3
country_id: 798544
description:
Nov 14 15:12:41 host2 sshd[3768832]: Disconnected from invalid user admin1 83.168.110.3 port 54324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.110.3
country_id: 798544
description:
Nov 14 15:16:15 host2 sshd[3771180]: Disconnected from invalid user smb 83.168.110.3 port 59832 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.63.56.43
country_id: 290291
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.63.56.43 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.161.211.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.161.211.188 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.19.35.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.19.35.145 - simpleengi "GET /login/?login_only=1&user=simpleengi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.17.187.89
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.17.187.89 - simpleengineeringlk "GET /login/?login_only=1&user=simpleengineeringlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineeringlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.135.222.251
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 139.135.222.251 - simpleengineerin "GET /login/?login_only=1&user=simpleengineerin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.119.255.223
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.119.255.223 - simpleengineeri "GET /login/?login_only=1&user=simpleengineeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.70.161.111
country_id: 390903
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 94.70.161.111 - simpleengineer "GET /login/?login_only=1&user=simpleengineer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.207.152.144
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 196.207.152.144 - simpleenginee "GET /login/?login_only=1&user=simpleenginee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleenginee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.163.207.123
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.163.207.123 - simpleengin "GET /login/?login_only=1&user=simpleengin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.97.164.160
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.97.164.160 - simpleeng "GET /login/?login_only=1&user=simpleeng&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleeng (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.86.110.210
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.86.110.210 - simpleengineering "GET /login/?login_only=1&user=simpleengineering&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineering (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.47.142.112
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 49.47.142.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.74.200.252
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.74.200.252 - simpleengine "GET /login/?login_only=1&user=simpleengine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.77.141.185
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 106.77.141.185 - simplee2 "GET /login/?login_only=1&user=simplee2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.153.241.70
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.153.241.70 - simplee "GET /login/?login_only=1&user=simplee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.250.228.181
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 130.250.228.181 - simple "GET /login/?login_only=1&user=simple&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simple (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.33.6
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.164.33.6 - simp "GET /login/?login_only=1&user=simp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.7.229
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.7.229 - sim "GET /login/?login_only=1&user=sim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.88.147.243
country_id: 1522867
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 81.88.147.243 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.0.179.158
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.0.179.158 - simplee1 "GET /login/?login_only=1&user=simplee1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.6.120.70
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.6.120.70 - simpl "GET /login/?login_only=1&user=simpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 15:23:31 host2 sshd[3774933]: Disconnected from invalid user  2.57.121.112 port 61233 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
country_id: 6252001
description:
2025-11-14 15:24:23 dovecot_login authenticator failed for ([162.186.17.150]) [162.186.17.150]:40350: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-11-14 15:24:39 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:38170: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.53
country_id: 6252001
description:
2025-11-14 15:29:37 dovecot_login authenticator failed for (ADMIN) [95.181.238.53]:55448: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.209.101.132
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.209.101.132 - anandaob "GET /login/?login_only=1&user=anandaob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.200.141.212
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 87.200.141.212 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.129.183.86
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.129.183.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.135.96.241
country_id: 146669
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 185.135.96.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.67.32.23
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 151.67.32.23 - anandaobauaeorg "GET /login/?login_only=1&user=anandaobauaeorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauaeorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.88.93.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.88.93.171 - anandaobau "GET /login/?login_only=1&user=anandaobau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.128.161.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.128.161.212 - anandao "GET /login/?login_only=1&user=anandao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.87.68.216
country_id: 1527747
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.87.68.216 - anandaobauae "GET /login/?login_only=1&user=anandaobauae&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauae (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.179.102.129
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.179.102.129 - anandaobaua "GET /login/?login_only=1&user=anandaobaua&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobaua (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.181.0.6
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.181.0.6 - anandaoba "GET /login/?login_only=1&user=anandaoba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaoba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.93.176
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.81.93.176 - ananda "GET /login/?login_only=1&user=ananda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ananda (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 15:35:35 host2 sshd[3792319]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 155.93.251.157
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 155.93.251.157 - anand "GET /login/?login_only=1&user=anand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.219
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.237.119.219 - anan "GET /login/?login_only=1&user=anan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.151.248
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.189.151.248 - anandao1 "GET /login/?login_only=1&user=anandao1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.149
country_id: 1694008
description:
2025-11-14 15:35:37 dovecot_login authenticator failed for ([124.105.219.170]) [124.105.218.149]:43918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.135.169.197
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.135.169.197 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.250.252.136
country_id: 3437598
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.250.252.136 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.20.133
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.78.20.133 - anandao2 "GET /login/?login_only=1&user=anandao2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-14 15:36:25 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:53716: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 15:37:06 host2 sshd[3796374]: Disconnected from invalid user user 2.57.121.25 port 27832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.3
country_id: 3469034
description:
Nov 14 15:38:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.89.137.3, lip=66.85.158.91, TLS, session=<wbWRK4tDcdy+WYkD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.26
country_id: 798544
description:
Nov 14 15:38:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=109.125.247.26, lip=66.85.158.91, TLS, session=<ygXyLItD0sttffca>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.246.87.86
country_id: 2921044
description:
2025-11-14 15:38:36 H=([92.246.87.86]) [92.246.87.86]:62734 F=<zaapaiacelectric@gmail.com> rejected RCPT <contact@bostonlanka.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 15:39:23 host2 sshd[3797907]: Disconnected from invalid user admin 2.57.121.112 port 11183 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-14 15:47:18 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:45962: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-14 15:47:39 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:60521: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-11-14 15:47:50 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:47960: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.58
country_id: 3865483
description:
2025-11-14 15:47:55 dovecot_login authenticator failed for (ADMIN) [146.70.38.58]:10871: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.83.33
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 46.110.83.33 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-11-14 15:52:17 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (contorium) [73.183.74.177]:43472: 535 Incorrect authentication data (set_id=support@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 15:53:52 host2 sshd[3819500]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2025-11-14 15:53:35 dovecot_plain authenticator failed for (assisevan) [195.133.156.133]:48377: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 15:54:51 host2 sshd[3820550]: Disconnected from invalid user aryanna 62.60.131.157 port 38325 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.75
country_id: 3469034
description:
Nov 14 15:58:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=138.186.197.75, lip=66.85.158.91, TLS, session=<5mmedItDuZKKusVL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.87.249.99
country_id: 798544
description:
Nov 14 15:58:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=212.87.249.99, lip=66.85.158.91, TLS, session=<DQ3EdYtD6KvUV/lj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-11-14 16:00:01 dovecot_plain authenticator failed for (spasm) [65.20.160.107]:38195: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-14 16:03:14 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:53906: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.33
country_id: 2750405
description:
Nov 14 16:02:25 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=80.82.77.33, lip=66.85.158.92, session=<lMRyg4tDHLhQUk0h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-14 16:02:36 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:60384: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-11-14 16:02:45 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:44798: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-11-14 16:03:00 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:55186: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-14 16:03:00 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:55102: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-14 16:03:27 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (unced) [68.46.148.180]:52604: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:07:36 host2 sshd[3828601]: Disconnected from invalid user user42 172.245.168.112 port 48458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:09:56 host2 sshd[3829978]: Disconnected from invalid user bitrix 172.245.168.112 port 60012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.145.141
country_id: 6252001
description:
2025-11-14 16:10:13 dovecot_login authenticator failed for (ADMIN) [102.129.145.141]:48408: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:11:04 host2 sshd[3831027]: Disconnected from invalid user victor 172.245.168.112 port 51338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:12:07 host2 sshd[3831557]: Disconnected from invalid user cat 172.245.168.112 port 47332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:13:10 host2 sshd[3832341]: Disconnected from invalid user lee 172.245.168.112 port 35750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-11-14 16:12:29 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (polar) [66.177.30.53]:41610: 535 Incorrect authentication data (set_id=support@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:13:50 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<QVFKrItDxNcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:15:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<6ainsItDsIEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:16:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<WaIgt4tDgL8DlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.174.21.67
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.174.21.67 - greentaraceylon "GET /login/?login_only=1&user=greentaraceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylon (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:18:05 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<93iHu4tDwJwDlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.189.68.229
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.189.68.229 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.205.226.110
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.205.226.110 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.80.237.13
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 170.80.237.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.160.226.84
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 125.160.226.84 - greentaraceyloncom "GET /login/?login_only=1&user=greentaraceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 16:18:50 host2 pure-ftpd[3835517]: (?@217.119.139.27) [INFO] New connection from 217.119.139.27


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.3.151
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.158.3.151 - greentaracey "GET /login/?login_only=1&user=greentaracey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaracey (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:19:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<+3MJwItDBLYDlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.153.34
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.244.153.34 - greentaraceylo "GET /login/?login_only=1&user=greentaraceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.160.1
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.24.160.1 - greentaraceyl "GET /login/?login_only=1&user=greentaraceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.20.115
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.19.20.115 - greentarace "GET /login/?login_only=1&user=greentarace&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentarace (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.179.149.94
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.179.149.94 - greentarac "GET /login/?login_only=1&user=greentarac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentarac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.169.127.74
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.169.127.74 - gr "GET /login/?login_only=1&user=gr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.169.102.80
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.169.102.80 - greentar "GET /login/?login_only=1&user=greentar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.200.22
country_id: 3437598
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.158.200.22 - green "GET /login/?login_only=1&user=green&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user green (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.200.50.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.200.50.64 - greent "GET /login/?login_only=1&user=greent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.96.28.81
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.96.28.81 - gree "GET /login/?login_only=1&user=gree&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.208.244.43
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.208.244.43 - gre "GET /login/?login_only=1&user=gre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.115.218.237
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.115.218.237 - greenta1 "GET /login/?login_only=1&user=greenta1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.238.51.145
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.238.51.145 - greenta2 "GET /login/?login_only=1&user=greenta2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta2 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:19:26 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<xFZRwItDWIMDlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.209.10.22
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.209.10.22 - greentara "GET /login/?login_only=1&user=greentara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.254.82.44
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.254.82.44 - greenta "GET /login/?login_only=1&user=greenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta (has_cpuser_file failed)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:20:18 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<ZN9rw4tDmLEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.138
country_id: 3017382
description:
Nov 14 16:20:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.138, lip=66.85.158.91, session=<72hTxItDBYNb51mK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:20:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<y9zTxItD8NsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.246
country_id: 3017382
description:
Nov 14 16:20:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.246, lip=66.85.158.91, session=<NYHwxItDVYBb51n2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.141
country_id: 3017382
description:
Nov 14 16:20:57 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.141, lip=66.85.158.91, session=<HPHCxYtDF9Rb51mN>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:21:43 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<wTCAyItDbrcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:22:06 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<sivhyYtDvrQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:23:28 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<pLDGzotD/MUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.3
country_id: 6252001
description:
Nov 14 16:25:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.3, lip=66.85.158.92, session=<zd/91ItDr+dAPsUD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.134
country_id: 6252001
description:
Nov 14 16:25:45 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nbPq1otDw4JAPpyG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 14 16:25:50 host2 sshd[3839442]: Disconnected from invalid user steam 103.179.57.150 port 35482 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Nov 14 16:26:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<n1D714tDMOJAPpyE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov 14 16:25:26 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS: Connection closed, session=<DEHI1YtD+iNAPsUC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.83.162.167
country_id: 1168579
description:
Nov 14 16:25:28 host2 sshd[3839188]: Disconnected from invalid user steam 202.83.162.167 port 38634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 14 16:27:49 host2 sshd[3840455]: Disconnected from invalid user debian 103.179.57.150 port 49612 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 14 16:28:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<nBWv4YtDADhChJl7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov 14 16:30:18 host2 pure-ftpd[3842213]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.90
country_id: 2629691
description:
2025-11-14 16:29:26 dovecot_login authenticator failed for (ADMIN) [45.133.193.90]:59126: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.107
country_id: 6252001
description:
Nov 14 16:33:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.107, lip=66.85.158.92, TLS: Connection closed, session=<OaKW8YtDkvLHLZtr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 14 16:33:31 host2 sshd[3843871]: Disconnected from invalid user kafka 103.179.57.150 port 49436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.83.162.167
country_id: 1168579
description:
Nov 14 16:33:55 host2 sshd[3844014]: Disconnected from invalid user morteza 202.83.162.167 port 33428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.196.217
country_id: 3469034
description:
Nov 14 16:35:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=138.186.196.217, lip=66.85.158.91, TLS, session=<QQ9k94tDnaSKusTZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.43
country_id: 953987
description:
Nov 14 16:35:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.129.61.43, lip=66.85.158.91, TLS, session=<I8GS+ItD2I9mgT0r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.17.38
country_id: 3175395
description:
Nov 14 16:36:35 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.43.17.38, lip=66.85.158.91, TLS, session=<0KaK/ItDd925KxEm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.140
country_id: 3175395
description:
Nov 14 16:36:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=171.22.235.140, lip=66.85.158.91, TLS, session=<Nd24/YtDirirFuuM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.102.49.193
country_id: 2750405
description:
Nov 14 16:50:43 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.102.49.193, lip=66.85.158.91, session=<Kw82MIxDLpZeZjHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-14 16:51:27 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:54320: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.63
country_id: 6252001
description:
2025-11-14 16:58:54 dovecot_login authenticator failed for (ADMIN) [102.129.235.63]:59920: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-14 17:09:45 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:43870: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-14 17:09:25 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:48987: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 17:10:28 host2 sshd[3866301]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:13:40 host2 sshd[3867866]: Disconnected from invalid user develop 138.204.127.54 port 59471 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 14 17:14:15 host2 sshd[3868354]: Disconnected from invalid user admin 101.36.108.134 port 41280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:15:08 host2 sshd[3868839]: Disconnected from invalid user dev 138.204.127.54 port 45472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:17:58 host2 sshd[3870304]: Disconnected from invalid user peace 138.204.127.54 port 45714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.6
country_id: 1819730
description:
2025-11-14 17:18:49 dovecot_login authenticator failed for (m121-202-152-6.smartone.com) [121.202.152.6]:9263: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.52.82
country_id: 3374766
description:
2025-11-14 17:19:07 dovecot_login authenticator failed for ([102.209.52.82]) [102.209.52.82]:59283: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:19:26 host2 sshd[3871173]: Disconnected from invalid user steam 138.204.127.54 port 59942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 14 17:20:34 host2 sshd[3871910]: Disconnected from invalid user odoo13 152.32.144.167 port 35764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:20:50 host2 sshd[3872127]: Disconnected from invalid user hadoop 138.204.127.54 port 45951 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 14 17:22:07 host2 sshd[3873017]: Disconnected from invalid user dspace 101.36.108.134 port 40208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 14 17:21:53 host2 sshd[3872895]: Disconnected from invalid user postgres 152.32.144.167 port 41550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 14 17:23:23 host2 sshd[3873759]: Disconnected from invalid user server 101.36.108.134 port 34284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.253
country_id: 3469034
description:
Nov 14 17:23:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=191.53.128.253, lip=66.85.158.91, TLS, session=<mG3epIxD2qC/NYD9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.141
country_id: 1269750
description:
Nov 14 17:23:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=103.164.246.141, lip=66.85.158.91, TLS, session=<6twapoxDY91npPaN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 14 17:24:39 host2 sshd[3874529]: Disconnected from invalid user team1 152.32.144.167 port 52358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 14 17:24:42 host2 sshd[3874556]: Disconnected from invalid user team1 101.36.108.134 port 59296 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 17:28:52 host2 sshd[3877010]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov 14 17:31:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS: Connection closed, session=<CVUjw4xDvORChJl5>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 14 17:33:48 host2 sshd[3879512]: Disconnecting authenticating user root 173.24.18.140 port 42674: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 14 17:33:48 host2 sshd[3879512]: error: maximum authentication attempts exceeded for root from 173.24.18.140 port 42674 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 14 17:33:56 host2 sshd[3879559]: error: maximum authentication attempts exceeded for invalid user admin from 173.24.18.140 port 44432 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 14 17:33:57 host2 sshd[3879593]: Disconnecting invalid user admin 173.24.18.140 port 44796: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-11-14 17:36:27 dovecot_plain authenticator failed for (cofitea) [65.20.133.208]:40680: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.186.7
country_id: 1819730
description:
Nov 14 17:38:56 host2 sshd[3882299]: Disconnected from invalid user ociistst 223.197.186.7 port 60643 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-11-14 17:39:45 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:50658: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-11-14 17:40:06 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:64662: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:41:32 host2 sshd[3883724]: Disconnected from invalid user sdc 43.156.89.50 port 46564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-14 17:44:21 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:39204: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Nov 14 17:44:09 host2 sshd[3885105]: Disconnected from invalid user opsadmin 103.139.192.17 port 50608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.186.7
country_id: 1819730
description:
Nov 14 17:44:31 host2 sshd[3885366]: Disconnected from invalid user test 223.197.186.7 port 49891 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:45:40 host2 sshd[3886686]: Disconnected from invalid user dennis 43.156.89.50 port 34474 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.81
country_id: 6252001
description:
Nov 14 17:45:42 host2 pure-ftpd[3886700]: (?@199.45.155.81) [INFO] New connection from 199.45.155.81


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.197.186.7
country_id: 1819730
description:
Nov 14 17:46:12 host2 sshd[3886999]: Disconnected from invalid user dennis 223.197.186.7 port 26855 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.108.185
country_id: 3175395
description:
Nov 14 17:47:21 host2 sshd[3887744]: Disconnected from invalid user xiaoli 156.54.108.185 port 54597 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:48:58 host2 sshd[3888830]: Disconnected from invalid user sinusbot 43.156.89.50 port 41634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:52:19 host2 sshd[3891059]: Disconnected from invalid user rootadmin 43.156.89.50 port 48796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.17
country_id: 1643084
description:
Nov 14 17:52:31 host2 sshd[3891159]: Disconnected from invalid user student 103.139.192.17 port 39006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:53:54 host2 sshd[3891813]: Disconnected from invalid user dcm4chee 43.156.89.50 port 52364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.108.185
country_id: 3175395
description:
Nov 14 17:54:18 host2 sshd[3892353]: Disconnected from invalid user odoo 156.54.108.185 port 33846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.108.185
country_id: 3175395
description:
Nov 14 17:58:25 host2 sshd[3895820]: Disconnected from invalid user dennis 156.54.108.185 port 50616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.186.7
country_id: 1819730
description:
Nov 14 17:58:11 host2 sshd[3895732]: Disconnected from invalid user sdc 223.197.186.7 port 53401 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov 14 18:01:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: Connection closed, session=<V1yCLY1DnudChJmA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.221.4
country_id: 6252001
description:
2025-11-14 18:09:02 dovecot_login authenticator failed for (ADMIN) [37.19.221.4]:50804: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.159
country_id: 1880251
description:
Nov 14 18:09:26 host2 sshd[3903942]: Disconnected from invalid user gitea 45.78.206.159 port 60036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.159
country_id: 1880251
description:
Nov 14 18:14:39 host2 sshd[3907347]: Disconnected from invalid user gitlab 45.78.206.159 port 36512 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.120
country_id: 3469034
description:
Nov 14 18:15:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=138.186.197.120, lip=66.85.158.91, TLS, session=<GfHGX41D/6GKusV4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.143.194
country_id: 690791
description:
Nov 14 18:15:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=37.221.143.194, lip=66.85.158.91, TLS, session=<I7+sXo1D7Ool3Y/C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 18:21:50 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=217.119.139.27, lip=66.85.158.92, session=<9a8Pdo1DdtnZd4sb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.137.165
country_id: 6252001
description:
Nov 14 18:24:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.182.137.165, lip=66.85.158.91, session=<n5/UfY1D/oaTtoml>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.186
country_id: 6252001
description:
2025-11-14 18:27:40 dovecot_login authenticator failed for (ADMIN) [181.214.165.186]:60305: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:28:04 host2 sshd[3916094]: Disconnected from invalid user user15 92.85.115.214 port 37544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.91
country_id: 953987
description:
Nov 14 18:29:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=102.64.45.91, lip=66.85.158.91, TLS, session=<rfK7j41DN+BmQC1b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.156.235.155
country_id: 3175395
description:
Nov 14 18:28:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.156.235.155, lip=66.85.158.91, TLS, session=<kziOjo1D2qq5nOub>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 18:29:37 host2 sshd[3917169]: Disconnected from invalid user jefferson 62.60.131.157 port 22842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:31:13 host2 sshd[3918573]: Disconnected from invalid user user 92.85.115.214 port 34182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-14 18:31:40 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-14 18:31:53 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:59143: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.137.165
country_id: 6252001
description:
Nov 14 18:33:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.182.137.165, lip=66.85.158.92, session=<vXJAoI1D9KSTtoml>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:35:05 host2 sshd[3921546]: Disconnected from invalid user web 92.85.115.214 port 44736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.231.192.36
country_id: 1605651
description:
Nov 14 18:35:08 host2 sshd[3921530]: Disconnected from invalid user hydra 49.231.192.36 port 45491 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:37:49 host2 sshd[3923479]: Disconnected from invalid user pmf 92.85.115.214 port 51760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.231.192.36
country_id: 1605651
description:
Nov 14 18:37:53 host2 sshd[3923496]: Disconnected from invalid user ubuntu 49.231.192.36 port 60703 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:39:17 host2 sshd[3924579]: Disconnected from invalid user hb 92.85.115.214 port 55276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.242
country_id: 3175395
description:
Nov 14 18:39:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=217.26.179.242, lip=66.85.158.91, TLS, session=<3fZntI1DJo7ZGrPy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.239.36.237
country_id: 3996063
description:
2025-11-14 18:39:47 dovecot_login authenticator failed for ([200.239.36.237]) [200.239.36.237]:50182: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.51.154
country_id: 3175395
description:
Nov 14 18:39:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.77.51.154, lip=66.85.158.91, TLS, session=<bPt6tY1D3bC5TTOa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-11-14 18:40:04 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:56547: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 14 18:42:02 host2 pure-ftpd[3926738]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 14 18:42:03 host2 pure-ftpd[3926757]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.37
country_id: 2963597
description:
2025-11-14 18:43:08 dovecot_login authenticator failed for (ADMIN) [155.2.194.37]:6437: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.159
country_id: 1880251
description:
Nov 14 18:44:04 host2 sshd[3927962]: Disconnected from invalid user tezos 45.78.206.159 port 47058 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 18:46:03 host2 sshd[3929643]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.67
country_id: 831053
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.35.67.67 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-14 18:50:57 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (catib) [81.225.30.107]:36983: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-14 18:57:10 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:34362: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.89
country_id: 831053
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.35.67.89 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.70.75.10
country_id: 3469034
description:
Nov 14 18:58:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.70.75.10, lip=66.85.158.91, TLS, session=<HvUe+Y1DH8qxRksK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.103.27
country_id: 798544
description:
Nov 14 18:59:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=178.219.103.27, lip=66.85.158.91, TLS, session=<gEZT+o1DscGy22cb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.231.192.36
country_id: 1605651
description:
Nov 14 18:59:39 host2 sshd[3939033]: Disconnected from invalid user admin 49.231.192.36 port 41262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.84.10
country_id: 1605651
description:
Nov 14 19:01:17 host2 sshd[3940403]: Disconnected from invalid user teamspeak 49.228.84.10 port 56736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 14 19:02:07 host2 sshd[3940834]: Disconnected from invalid user zone 204.152.195.145 port 42032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.55
country_id: 597427
description:
2025-11-14 19:02:37 dovecot_login authenticator failed for (ADMIN) [194.32.122.55]:59948: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 19:03:43 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52716: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 19:04:40 host2 sshd[3942394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.84.10
country_id: 1605651
description:
Nov 14 19:06:00 host2 sshd[3943299]: Disconnected from invalid user light 49.228.84.10 port 38618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 14 19:07:57 host2 sshd[3944332]: Disconnected from invalid user wyk 204.152.195.145 port 42576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 14 19:10:13 host2 sshd[3945699]: Disconnected from invalid user wallabag 204.152.195.145 port 42804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.102.180.155
country_id: 6252001
description:
Nov 14 19:09:36 host2 sshd[3945217]: Disconnected from invalid user reza 67.102.180.155 port 56614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.102.180.155
country_id: 6252001
description:
Nov 14 19:10:52 host2 sshd[3945946]: Disconnected from invalid user kafka 67.102.180.155 port 59450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.213.226.156
country_id: 6252001
description:
Nov 14 19:16:15 host2 sshd[3949219]: Disconnected from invalid user finn 129.213.226.156 port 56094 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 14 19:16:13 host2 pure-ftpd[3949179]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.59.218
country_id: 1269750
description:
Nov 14 19:16:48 host2 sshd[3949414]: Disconnected from invalid user adama 125.21.59.218 port 44258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 19:18:23 host2 sshd[3950239]: Disconnected from invalid user  2.57.121.112 port 62701 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.237
country_id: 3469034
description:
Nov 14 19:19:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.251.237, lip=66.85.158.91, TLS, session=<rmiJQ45Dmae60fvt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 14 19:19:53 host2 pure-ftpd[3950996]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 14 19:19:53 host2 pure-ftpd[3951008]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.177
country_id: 3469034
description:
Nov 14 19:19:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=177.44.96.177, lip=66.85.158.91, TLS, session=<zA/RRI5DKoixLGCx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.213.226.156
country_id: 6252001
description:
Nov 14 19:20:56 host2 sshd[3951663]: Disconnected from invalid user vmarketing 129.213.226.156 port 57004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.156.106
country_id: 1880251
description:
Nov 14 19:21:11 host2 sshd[3951818]: Disconnected from invalid user rahul 8.219.156.106 port 48434 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.40
country_id: 2635167
description:
Nov 14 19:24:41 host2 pure-ftpd[3953445]: (?@185.247.137.40) [INFO] New connection from 185.247.137.40


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 19:25:13 host2 sshd[3953778]: Disconnected from invalid user jefferson 62.60.131.157 port 19268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-11-14 19:26:27 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:42596: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-14 19:26:47 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:32952: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-11-14 19:27:44 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:58036: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 19:28:00 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=217.119.139.27, lip=66.85.158.92, session=<OQ2tYo5DsLHZd4sb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-11-14 19:28:13 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:55268: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.226
country_id: 3017382
description:
2025-11-14 19:28:33 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.226]:45354: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.23
country_id: 174982
description:
2025-11-14 19:29:42 dovecot_login authenticator failed for (ADMIN) [185.253.160.23]:48506: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.66
country_id: 831053
description:
[2025-11-14 19:29:52 +0530] info [cpaneld] 37.35.67.66 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-14 19:34:41 dovecot_login authenticator failed for ([179.185.18.67]) [179.185.18.67]:47312: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.16
country_id: 1269750
description:
2025-11-14 19:35:03 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:38026: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.107.6
country_id: 798544
description:
Nov 14 19:38:07 host2 sshd[3961555]: Disconnected from invalid user ubuntu 83.168.107.6 port 41084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.107.6
country_id: 798544
description:
Nov 14 19:40:57 host2 sshd[3963342]: Disconnected from invalid user user1 83.168.107.6 port 48310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:41:15 host2 sshd[3963497]: Disconnected from invalid user marlon 189.126.4.42 port 37540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.107.6
country_id: 798544
description:
Nov 14 19:42:10 host2 sshd[3963967]: Disconnected from invalid user paul 83.168.107.6 port 37026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 19:42:31 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=217.119.139.27, lip=66.85.158.91, session=<Vw6Xlo5Drr7Zd4sb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:44:25 host2 sshd[3965410]: Disconnected from invalid user sysadmin 189.126.4.42 port 43378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.107.6
country_id: 798544
description:
Nov 14 19:45:05 host2 sshd[3965953]: Disconnected from invalid user master 83.168.107.6 port 51886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:45:55 host2 sshd[3966815]: Disconnected from invalid user ruth 189.126.4.42 port 46464 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:47:25 host2 sshd[3967639]: Disconnected from invalid user chris 189.126.4.42 port 49394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Nov 14 19:47:30 host2 sshd[3967668]: Disconnected from invalid user sangoma 187.107.88.97 port 37294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:48:48 host2 sshd[3968304]: Disconnected from invalid user test 189.126.4.42 port 52422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.40
country_id: 617790
description:
2025-11-14 19:50:32 dovecot_login authenticator failed for (ADMIN) [178.175.128.40]:54843: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-14 19:51:15 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:36940: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-11-14 19:51:34 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:38194: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.41.154.21
country_id: 3017382
description:
2025-11-14 19:52:35 dovecot_plain authenticator failed for vps-83371.fhnet.fr (vps-83371.firstheberg.net) [185.41.154.21]:52507: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.57
country_id: 6251999
description:
Nov 14 19:55:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.57, lip=66.85.158.91, session=<zCoXxY5DJLaUccE5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.107.88.97
country_id: 3469034
description:
Nov 14 20:00:19 host2 sshd[3976031]: Disconnected from invalid user master 187.107.88.97 port 49671 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 20:01:56 host2 sshd[3976840]: Disconnected from invalid user admin 2.57.121.112 port 48758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.198.17.88
country_id: 130758
description:
Nov 14 20:02:06 host2 sshd[3976921]: Disconnected from invalid user jason 85.198.17.88 port 52782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Nov 14 20:06:48 host2 sshd[3980070]: Disconnected from invalid user rustserver 187.107.88.97 port 40063 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.3.205
country_id: 2661886
description:
2025-11-14 20:09:20 dovecot_login authenticator failed for (ADMIN) [46.246.3.205]:9577: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 14 20:09:31 host2 sshd[3981898]: Disconnected from invalid user administrator 135.235.138.43 port 42512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 14 20:11:09 host2 sshd[3982825]: Disconnected from invalid user docker 135.235.138.43 port 47772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 14 20:14:09 host2 sshd[3984598]: Disconnected from invalid user ambari 135.235.138.43 port 35170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 14 20:19:04 host2 sshd[3987167]: Disconnected from invalid user fahim 135.235.138.43 port 37094 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 20:22:20 host2 sshd[3988760]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.222.81
country_id: 6252001
description:
Nov 14 20:21:39 host2 pure-ftpd[3988435]: (?@146.190.222.81) [INFO] New connection from 146.190.222.81


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 14 20:22:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<IR+vJo9D9GxChJmL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.186
country_id: 226074
description:
Nov 14 20:24:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=196.0.107.186, lip=66.85.158.91, TLS, session=<TjFeKo9DgpTEAGu6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.80.18
country_id: 1269750
description:
Nov 14 20:23:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.30.80.18, lip=66.85.158.91, TLS, session=<fnw/KI9DeddnHlAS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.186
country_id: 3469034
description:
Nov 14 20:23:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=186.209.251.186, lip=66.85.158.91, TLS, session=<+naHKY9Ddt660fu6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.18
country_id: 226074
description:
Nov 14 20:24:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<jagath.peiris>, method=PLAIN, rip=196.0.10.18, lip=66.85.158.91, TLS, session=<6EixK49D06bEAAoS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.0.20
country_id: 2750405
description:
Nov 14 20:25:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.0.20, lip=66.85.158.92, TLS: Connection closed, session=<YAerMY9D5pyf3wAU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.201
country_id: 798549
description:
2025-11-14 20:29:21 dovecot_login authenticator failed for (ADMIN) [91.90.120.201]:32382: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:30:56 host2 sshd[3993895]: Disconnected from invalid user debian 154.82.84.134 port 38168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 20:30:41 host2 sshd[3993791]: Disconnected from invalid user user 2.57.121.25 port 26051 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.22.82
country_id: 2921044
description:
Nov 14 20:32:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.22.82, lip=66.85.158.91, TLS handshaking: Connection closed, session=<30GSSI9DppKd5hZS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:32:24 host2 sshd[3994601]: Disconnected from invalid user deploy 154.82.84.134 port 33348 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.28.108
country_id: 2921044
description:
Nov 14 20:31:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.28.108, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<UYN2Ro9Dg7lo+Bxs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-11-14 20:37:05 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:42260: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.239.36.237
country_id: 3996063
description:
2025-11-14 20:37:22 dovecot_login authenticator failed for ([200.239.36.237]) [200.239.36.237]:40220: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.198.17.88
country_id: 130758
description:
Nov 14 20:37:34 host2 sshd[3997560]: Disconnected from invalid user docker 85.198.17.88 port 50832 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:38:35 host2 sshd[3998057]: Disconnected from invalid user deploy 154.82.84.134 port 50400 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 20:40:58 host2 sshd[3999363]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:41:32 host2 sshd[3999713]: Disconnected from invalid user username 154.82.84.134 port 42448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:43:03 host2 sshd[4000417]: Disconnected from invalid user ftptest 154.82.84.134 port 60220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.20
country_id: 1522867
description:
2025-11-14 20:52:44 dovecot_login authenticator failed for (ADMIN) [62.133.47.20]:19052: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.218
country_id: 6252001
description:
Nov 14 20:56:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.218, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<snOFnY9Dm8Ci2Jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.42.20
country_id: 2395170
description:
Nov 14 20:57:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=154.127.42.20, lip=66.85.158.91, TLS, session=<FoEsoY9D06qafyoU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.42
country_id: 298795
description:
Nov 14 20:57:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=95.0.171.42, lip=66.85.158.91, TLS, session=<8P9Zoo9DrMFfAKsq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.218
country_id: 6252001
description:
Nov 14 21:02:16 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.218, lip=66.85.158.91, TLS, session=<whTUs49DSOii2Jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.216
country_id: 6252001
description:
2025-11-14 21:13:36 dovecot_login authenticator failed for (ADMIN) [181.215.182.216]:57828: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.184.82.46
country_id: 798544
description:
Nov 14 21:13:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=195.184.82.46, lip=66.85.158.91, TLS, session=<FiuI249Dfc/DuFIu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.171.150.189
country_id: 3469034
description:
Nov 14 21:13:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=45.171.150.189, lip=66.85.158.91, TLS, session=<8USq3I9DtNgtq5a9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.160.172.181
country_id: 798544
description:
Nov 14 21:16:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=82.160.172.181, lip=66.85.158.91, TLS, session=<01kB5Y9Dx5pSoKy1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.78.89.44
country_id: 298795
description:
Nov 14 21:16:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=94.78.89.44, lip=66.85.158.91, TLS, session=<KkoZ5o9Do7ReTlks>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-11-14 21:17:18 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:39482: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.131.8.20
country_id: 1168579
description:
2025-11-14 21:17:41 dovecot_login authenticator failed for ([103.131.8.20]) [103.131.8.20]:52106: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.252.75
country_id: 3865483
description:
Nov 14 21:23:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=200.229.252.75, lip=66.85.158.91, TLS, session=<1veu/o9DILrI5fxL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.41.84.60
country_id: 798544
description:
Nov 14 21:23:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=31.41.84.60, lip=66.85.158.91, TLS, session=<eWPp/49DjpIfKVQ8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.198.17.88
country_id: 130758
description:
Nov 14 21:24:56 host2 sshd[4024824]: Disconnected from invalid user proradis 85.198.17.88 port 36010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:25:11 host2 sshd[4025254]: Disconnected from invalid user suraj 84.241.107.69 port 49756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.17
country_id: 1733045
description:
2025-11-14 21:25:13 dovecot_login authenticator failed for ([49.124.151.17]) [49.124.151.17]:41222: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-11-14 21:25:28 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:39514: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 21:26:40 host2 sshd[4025934]: Disconnected from invalid user admin 2.57.121.112 port 55903 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-14 21:27:16 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:52862: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-11-14 21:27:52 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:52984: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov 14 21:28:37 host2 pure-ftpd[4026824]: (?@64.62.156.182) [INFO] New connection from 64.62.156.182


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:29:22 host2 sshd[4027273]: Disconnected from invalid user clamav 84.241.107.69 port 50438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:29:54 host2 sshd[4027621]: Disconnected from invalid user super 118.193.40.35 port 49194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Nov 14 21:30:03 host2 sshd[4027728]: Disconnected from invalid user hieu 202.157.177.33 port 58100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:31:41 host2 sshd[4028712]: Disconnected from invalid user user123 84.241.107.69 port 58552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Nov 14 21:32:50 host2 sshd[4029580]: Disconnected from invalid user clamav 202.157.177.33 port 47816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:34:10 host2 sshd[4030834]: Disconnected from invalid user testadmin 118.193.40.35 port 8314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.164
country_id: 3865483
description:
Nov 14 21:35:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=190.122.128.164, lip=66.85.158.91, TLS, session=<X7mlKpBDgca+eoCk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:35:13 host2 sshd[4031560]: Disconnected from invalid user ftpuser 84.241.107.69 port 36176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.105.102
country_id: 6252001
description:
2025-11-14 21:35:21 dovecot_login authenticator failed for (ADMIN) [154.16.105.102]:6887: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.33.78.42
country_id: 3469034
description:
Nov 14 21:35:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.33.78.42, lip=66.85.158.91, TLS, session=<Uz5gKZBDZ+q7IU4q>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.70
country_id: 831053
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.35.67.70 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:36:18 host2 sshd[4032171]: Disconnected from invalid user ubuntu 84.241.107.69 port 33592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:40:53 host2 sshd[4034426]: Disconnected from invalid user account 84.241.107.69 port 44164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.33
country_id: 1733045
description:
Nov 14 21:42:05 host2 sshd[4035116]: Disconnected from invalid user tomas 202.157.177.33 port 48488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:42:36 host2 sshd[4035307]: Disconnected from invalid user ftpuser 118.193.40.35 port 1638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Nov 14 21:43:26 host2 sshd[4035750]: Disconnected from invalid user ansible 202.157.177.33 port 46636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:46:52 host2 sshd[4037552]: Disconnected from invalid user tomas 84.241.107.69 port 34290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:47:31 host2 sshd[4037838]: Disconnected from invalid user admin 118.193.40.35 port 47478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:47:42 host2 sshd[4037901]: Disconnected from invalid user user12 79.106.102.70 port 48434 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 14 21:48:55 host2 pure-ftpd[4038573]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 14 21:48:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<E46gWpBD1oYzn+p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 14 21:50:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<r6l9YZBD0lpBMRRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 14 21:51:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, session=<RkwuYpBDPJq4affD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:51:31 host2 sshd[4040071]: Disconnected from invalid user wd 79.106.102.70 port 36772 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 14 21:51:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS: Connection closed, session=<75/sYpBDkom4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 14 21:51:16 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<klsIY5BDtlxBMRRC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:52:50 host2 sshd[4040607]: Disconnected from invalid user cesar 79.106.102.70 port 41674 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.185.240
country_id: 6252001
description:
Nov 14 21:53:42 host2 pure-ftpd[4041024]: (?@44.220.185.240) [INFO] New connection from 44.220.185.240


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:55:34 host2 sshd[4042487]: Disconnected from invalid user vod 118.193.40.35 port 19254 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.222.81
country_id: 6252001
description:
Nov 14 21:56:02 host2 pure-ftpd[4042732]: (?@146.190.222.81) [INFO] New connection from 146.190.222.81


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:56:33 host2 sshd[4043035]: Disconnected from invalid user filip 79.106.102.70 port 57858 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.112
country_id: 6252001
description:
Nov 14 21:57:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.112, lip=66.85.158.91, session=<8lbHeZBDoJoUQcFw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 21:58:13 host2 sshd[4044909]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.129.35
country_id: 617790
description:
2025-11-14 21:58:26 dovecot_login authenticator failed for (ADMIN) [178.175.129.35]:47002: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:59:01 host2 sshd[4045429]: Disconnected from invalid user user 79.106.102.70 port 46420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:00:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MvKyhZBDYd+i2JXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:01:19 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<OsIDh5BDRPyi2JXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:02:20 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<YEehipBDAvai2JXs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Nov 14 22:02:41 host2 sshd[4048510]: Disconnected from invalid user zahid 155.93.89.195 port 34570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.93.89.195
country_id: 2328926
description:
Nov 14 22:07:49 host2 sshd[4065575]: Disconnected from invalid user samba 155.93.89.195 port 36536 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.38
country_id: 6252001
description:
Nov 14 22:07:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6R26npBDmUFAPpwm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:07:34 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS, session=<ys1YnZBD5vGi2JXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.38
country_id: 6252001
description:
Nov 14 22:08:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<kle+n5BDpLhAPpwm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:08:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS, session=<TNUVoZBDrPmi2JXs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-11-14 22:13:33 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (aguiselege) [69.123.219.82]:53911: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-11-14 22:14:09 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (shious) [76.145.10.140]:57282: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Nov 14 22:14:20 host2 sshd[4069237]: Disconnected from invalid user odoo 155.93.89.195 port 40698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-14 22:16:09 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:33081: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-14 22:16:29 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:33684: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.82.22
country_id: 6252001
description:
Nov 14 22:20:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.165.82.22, lip=66.85.158.92, session=<8573yZBDnM00pVIW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 14 22:21:40 host2 sshd[4073004]: Disconnected from invalid user ibrahim 103.106.194.74 port 42042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.196
country_id: 798549
description:
2025-11-14 22:23:10 dovecot_login authenticator failed for (ADMIN) [91.90.120.196]:7809: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 14 22:24:38 host2 sshd[4074265]: Disconnected from invalid user teamspeak 103.106.194.74 port 37948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.211.140
country_id: 3175395
description:
Nov 14 22:31:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=94.198.211.140, lip=66.85.158.91, TLS, session=<sRC98JBDEbZextOM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.81
country_id: 3996063
description:
Nov 14 22:31:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=138.122.97.81, lip=66.85.158.91, TLS, session=<PmLr8ZBDS66KemFR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.81
country_id: 6252001
description:
Nov 14 22:37:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.81, lip=66.85.158.91, session=<JPagBpFD6RBBMQFR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov 14 22:37:10 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.80, lip=66.85.158.91, TLS: Connection closed, session=<+Oc7B5FDmH9BMQFQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-14 22:37:20 dovecot_plain authenticator failed for (impaske) [46.8.245.34]:44276: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.119
country_id: 6251999
description:
2025-11-14 22:41:24 dovecot_login authenticator failed for (ADMIN) [89.149.52.119]:36363: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.212
country_id: 6252001
description:
Nov 14 22:42:37 host2 pure-ftpd[4084503]: (?@64.62.197.212) [INFO] New connection from 64.62.197.212


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.183
country_id: 6252001
description:
Nov 14 22:43:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.183, lip=66.85.158.91, session=<IJMEH5FDbIkUQcG3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.102.92.72
country_id: 6252001
description:
Nov 14 22:45:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.102.92.72, lip=66.85.158.92, session=<1+51I5FDhIQUZlxI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.82.66
country_id: 1269750
description:
Nov 14 22:45:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=103.30.82.66, lip=66.85.158.91, TLS, session=<CousJJFDj99nHlJC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.109
country_id: 953987
description:
Nov 14 22:45:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.64.33.109, lip=66.85.158.91, TLS, session=<hH5jI5FD9odmQCFt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.186.228.106
country_id: 3923057
description:
2025-11-14 22:45:43 dovecot_login authenticator failed for (static-ip-adsl-190.186.228.106.cotas.com.bo) [190.186.228.106]:53118: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-14 22:46:08 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:53549: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 22:49:19 host2 sshd[4088725]: Disconnected from invalid user admin 2.57.121.112 port 56322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 22:51:38 host2 sshd[4089996]: Disconnected from invalid user service 2.57.121.112 port 62217 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 22:57:09 host2 sshd[4093812]: Disconnected from invalid user dallas 62.60.131.157 port 8014 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.40
country_id: 6252001
description:
Nov 14 22:57:45 host2 pure-ftpd[4094055]: (?@147.185.132.40) [INFO] New connection from 147.185.132.40


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 22:58:13 host2 sshd[4094361]: Disconnected from invalid user  2.57.121.112 port 61204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.9
country_id: 1227603
description:
2025-11-14 23:03:49 dovecot_login authenticator failed for (ADMIN) [95.181.239.9]:52052: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.111
country_id: 6252001
description:
Nov 14 23:06:18 host2 pure-ftpd[4099242]: (?@147.185.132.111) [INFO] New connection from 147.185.132.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 23:07:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62513: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov 14 23:09:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.91, session=<HMG2eZFD1tKUcd0c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.42
country_id: 6252001
description:
Nov 14 23:21:11 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rpWhpJFDIuMUQcIq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.241.35
country_id: 6252001
description:
Nov 14 23:21:26 host2 pure-ftpd[4109412]: (?@20.118.241.35) [INFO] New connection from 20.118.241.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 23:24:24 host2 sshd[4110908]: Disconnected from invalid user admin 2.57.121.112 port 9480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.225
country_id: 6252001
description:
Nov 14 23:25:16 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.175.225, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<khA4s5FD7MIofK/h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.19.45
country_id: 3175395
description:
Nov 14 23:25:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.43.19.45, lip=66.85.158.91, TLS, session=<GI7gspFDnoW5KxMt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.179.38
country_id: 3175395
description:
Nov 14 23:25:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.68.179.38, lip=66.85.158.91, TLS, session=<o/T6s5FD/oq5RLMm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.30
country_id: 3042225
description:
2025-11-14 23:25:59 dovecot_login authenticator failed for (ADMIN) [91.90.124.30]:64502: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 23:29:16 host2 sshd[4113794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.254.230
country_id: 2921044
description:
Nov 14 23:28:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=207.154.254.230, lip=66.85.158.91, session=<4u4BwJFDdyjPmv7m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.215.207
country_id: 2921044
description:
Nov 14 23:28:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.59.215.207, lip=66.85.158.91, session=<3B0QwJFD6gWLO9fP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.249.221.45
country_id: 6252001
description:
Nov 14 23:32:49 host2 pure-ftpd[4115783]: (?@52.249.221.45) [INFO] New connection from 52.249.221.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:12 host2 pure-ftpd[4118276]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:17 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.92, TLS, session=<k8oz3pFDHueUccE7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:26 host2 pure-ftpd[4118382]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:26 host2 pure-ftpd[4118384]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xMHZ3pFDpuGUccE7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 23:44:43 host2 sshd[4122088]: Disconnected from invalid user user 2.57.121.25 port 22355 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 23:47:23 host2 sshd[4124165]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.149
country_id: 2782113
description:
2025-11-14 23:47:33 dovecot_login authenticator failed for (ADMIN) [156.146.60.149]:38342: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-14 23:48:28 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:49569: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-11-14 23:48:38 dovecot_login authenticator failed for (24-105-248-218.ip.mhcable.com) [24.105.248.218]:41320: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.36.183
country_id: 953987
description:
Nov 14 23:49:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=102.64.36.183, lip=66.85.158.91, TLS, session=<HKgGCpJDfNJmQCS3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-14 23:50:20 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (graver) [85.225.19.144]:58273: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.82.157.205
country_id: 1269750
description:
Nov 14 23:49:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.82.157.205, lip=66.85.158.91, TLS, session=<ms21CJJDhcZnUp3N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.171
country_id: 6252001
description:
Nov 15 00:03:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.171, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PyCoO5JDvdDG6xir>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.193.17
country_id: 2750405
description:
Nov 15 00:05:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=159.65.193.17, lip=66.85.158.91, TLS: Connection closed, session=<vzZrQZJDbOefQcER>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.58
country_id: 6251999
description:
2025-11-15 00:06:05 dovecot_login authenticator failed for (ADMIN) [212.56.52.58]:57708: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 00:07:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9M9HS5JDNsa4aYtF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 00:08:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, TLS: Connection closed, session=<mzNwTZJDWE24aYtF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 00:10:16 host2 sshd[4140189]: Disconnected from invalid user admin 2.57.121.112 port 20058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.199.171.246
country_id: 1269750
description:
2025-11-15 00:09:28 dovecot_login authenticator failed for ([116.199.171.246]) [116.199.171.246]:40226: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-11-15 00:09:55 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:54422: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.146.105
country_id: 690791
description:
Nov 15 00:10:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.221.146.105, lip=66.85.158.91, TLS, session=<DZoXVJJD68ol3ZJp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.158
country_id: 3865483
description:
Nov 15 00:10:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=45.238.106.158, lip=66.85.158.91, TLS, session=<BNaDVZJDK8It7mqe>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.148
country_id: 6252001
description:
Nov 15 00:13:48 host2 pure-ftpd[4142285]: (?@20.65.193.148) [INFO] New connection from 20.65.193.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-15 00:14:40 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:33312: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.158.224.90
country_id: 2658434
description:
2025-11-15 00:15:09 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:57288: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-15 00:16:28 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:35766: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-15 00:16:46 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:10360: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.78
country_id: 6252001
description:
Nov 15 00:17:33 host2 pure-ftpd[4145581]: (?@135.237.125.78) [INFO] New connection from 135.237.125.78


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.66
country_id: 6252001
description:
Nov 15 00:21:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.66, lip=66.85.158.91, TLS: Connection closed, session=<MiavepJDiKbHLZtC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 37.19.200.153
country_id: 6252001
description:
Nov 15 00:24:35 host2 pure-ftpd[4150157]: (?@37.19.200.153) [INFO] New connection from 37.19.200.153


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.22.203
country_id: 1819730
description:
Nov 15 00:29:58 host2 sshd[4153215]: Disconnected from invalid user didi 154.221.22.203 port 50210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.142
country_id: 3077311
description:
2025-11-15 00:30:28 dovecot_login authenticator failed for (ADMIN) [212.102.39.142]:9829: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Nov 15 00:33:32 host2 sshd[4155459]: Disconnected from invalid user dontstarve 154.221.22.203 port 56794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-15 00:34:14 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (glitymon) [73.195.211.98]:32848: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 00:44:54 host2 sshd[4161639]: Disconnected from invalid user  2.57.121.112 port 61718 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.138.167
country_id: 2921044
description:
Nov 15 00:46:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.59.138.167, lip=66.85.158.91, TLS, session=<gOc51JJDCvCLO4qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.40
country_id: 1269750
description:
Nov 15 00:47:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.18.166.40, lip=66.85.158.91, TLS, session=<rNCX15JDONtnEqYo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.107.191
country_id: 3469034
description:
Nov 15 00:47:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=187.85.107.191, lip=66.85.158.91, TLS, session=<QlTg2JJD9ay7VWu/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-15 00:48:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (nonress) [87.103.126.54]:51990: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 00:51:22 host2 sshd[4166950]: Disconnected from invalid user minh 2.57.121.112 port 61960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-15 00:51:39 dovecot_login authenticator failed for ([182.76.108.121]) [182.78.159.82]:36354: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.121
country_id: 3996063
description:
2025-11-15 00:51:57 dovecot_login authenticator failed for ([201.173.216.121]) [201.173.216.121]:41023: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.116
country_id: 2635167
description:
Nov 15 01:02:13 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.116, lip=66.85.158.91, TLS, session=<BM/1DZNDH71X7LB0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 01:03:06 host2 sshd[4173869]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.90.142.216
country_id: 3077311
description:
Nov 15 01:08:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=80.90.142.216, lip=66.85.158.91, TLS, session=<H96VIpNDowhQWo7Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.70
country_id: 3175395
description:
Nov 15 01:08:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=217.26.179.70, lip=66.85.158.91, TLS, session=<Zb3FI5ND/+bZGrNG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.58
country_id: 6251999
description:
2025-11-15 01:19:48 dovecot_login authenticator failed for (ADMIN) [66.56.80.58]:33090: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 01:21:06 host2 sshd[4184473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.86
country_id: 6252001
description:
Nov 15 01:23:51 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.86, lip=66.85.158.92, session=<0OBPW5NDZJ6s7ORW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Nov 15 01:24:19 host2 sshd[4186193]: Disconnected from invalid user wwww 42.200.78.78 port 33568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Nov 15 01:26:01 host2 sshd[4187122]: Disconnected from invalid user ftpuser 42.200.78.78 port 40578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Nov 15 01:27:22 host2 sshd[4187851]: Disconnected from invalid user jeus 42.200.78.78 port 43490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Nov 15 01:30:01 host2 sshd[4189133]: Disconnected from invalid user steam 42.200.78.78 port 49320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-11-15 01:36:19 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:64163: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-11-15 01:36:33 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:48922: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-15 01:38:08 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (garamods) [98.227.25.115]:45350: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.112.209
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 163.5.112.209 - cloudt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.36
country_id: 3175395
description:
Nov 15 01:44:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=195.177.113.36, lip=66.85.158.91, TLS, session=<oKewpZNDGIrDsXEk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.108.125
country_id: 3865483
description:
Nov 15 01:45:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=190.181.108.125, lip=66.85.158.91, TLS, session=<BIfippNDJJG+tWx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.158
country_id: 6252001
description:
2025-11-15 01:45:47 dovecot_login authenticator failed for (ADMIN) [79.127.132.158]:53226: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.217.108
country_id: 2921044
description:
Nov 15 01:49:42 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.217.108, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<qde+t5NDvYnRJtls>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.184.19
country_id: 2921044
description:
Nov 15 01:50:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.90.184.19, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SlrYuZNDwBikWrgT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-11-15 01:54:18 dovecot_login authenticator failed for ([206.217.141.77]) [206.217.141.77]:60050: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.15.69
country_id: 3469034
description:
2025-11-15 01:54:33 dovecot_login authenticator failed for ([177.174.15.89]) [177.174.15.69]:50511: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 15 01:58:13 host2 sshd[12662]: Disconnected from invalid user chromeuser 143.110.186.36 port 54128 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 15 02:02:15 host2 sshd[15710]: Disconnected from invalid user sri 143.110.186.36 port 43070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.150
country_id: 2328926
description:
2025-11-15 02:03:38 dovecot_login authenticator failed for (ADMIN) [146.70.65.150]:56444: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.59
country_id: 953987
description:
Nov 15 02:05:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.32.59, lip=66.85.158.91, TLS, session=<P5uC8JNDmsZmQCA7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.101.145
country_id: 798544
description:
Nov 15 02:06:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=178.219.101.145, lip=66.85.158.91, TLS, session=<xavQ8ZNDteWy22WR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 15 02:08:11 host2 sshd[19371]: Disconnected from invalid user etienne 139.59.66.39 port 56992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 15 02:07:30 host2 sshd[19089]: Disconnected from invalid user ubuntu 143.110.186.36 port 46434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 15 02:10:46 host2 sshd[21094]: Disconnected from invalid user trans 139.59.66.39 port 40576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 02:12:18 host2 sshd[21773]: Disconnected from invalid user user 2.57.121.25 port 48859 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 15 02:13:21 host2 sshd[22785]: Disconnected from invalid user sri 139.59.66.39 port 58014 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.19.44
country_id: 2921044
description:
Nov 15 02:13:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=159.223.19.44, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QyekDZRDaHef3xMs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 15 02:21:06 host2 sshd[27349]: Disconnected from invalid user desliga 103.231.14.54 port 36248 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 15 02:22:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<t3ahK5RDWlQv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.92.22
country_id: 6252001
description:
Nov 15 02:21:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.92.22, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<sgXWKZRDdrkv+1wW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 15 02:22:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<IKUeLJRD7OMv+zWT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 15 02:23:50 host2 sshd[28686]: Disconnected from invalid user frappe 103.231.14.54 port 51462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-15 02:24:59 dovecot_plain authenticator failed for (brivauty) [62.74.225.186]:34273: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-15 02:25:59 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:53208: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-11-15 02:26:28 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:35081: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.62
country_id: 1668284
description:
2025-11-15 02:28:12 dovecot_login authenticator failed for (ADMIN) [173.244.49.62]:52616: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.112.209
country_id: 3017382
description:
[2025-11-15 02:27:44 +0530] info [whostmgrd] 163.5.112.209 - cloudt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 15 02:29:16 host2 sshd[31962]: Disconnected from invalid user me 103.231.14.54 port 49034 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.188.199
country_id: 6252001
description:
Nov 15 02:32:04 host2 pure-ftpd[33534]: (?@44.220.188.199) [INFO] New connection from 44.220.188.199


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 02:34:47 host2 sshd[34769]: Disconnected from invalid user  2.57.121.112 port 61316 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 02:36:30 host2 sshd[35919]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.43.156
country_id: 732800
description:
2025-11-15 02:36:26 dovecot_login authenticator failed for 77-85-43-156.ip.btc-net.bg [77.85.43.156]:39066: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.226
country_id: 3017382
description:
2025-11-15 02:36:52 dovecot_login authenticator failed for ([46.254.229.4]) [185.137.75.226]:51384: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 02:41:08 host2 sshd[38464]: Disconnected from invalid user moth3r 2.57.121.112 port 62635 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-11-15 02:40:55 dovecot_plain authenticator failed for (sulamelize) [24.93.140.162]:47463: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.27.3
country_id: 933860
description:
Nov 15 02:42:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=83.143.27.3, lip=66.85.158.91, TLS, session=<MuFSc5RDoNxTjxsD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.30
country_id: 732800
description:
Nov 15 02:42:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=185.255.212.30, lip=66.85.158.91, TLS, session=<AU6CdJRDTca5/9Qe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.28
country_id: 6290252
description:
2025-11-15 02:45:38 dovecot_login authenticator failed for (ADMIN) [37.46.115.28]:44982: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.161.174.170
country_id: 6251999
description:
Nov 15 02:46:48 host2 pure-ftpd[42306]: (?@51.161.174.170) [INFO] New connection from 51.161.174.170


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 51.161.174.170
country_id: 6251999
description:
Nov 15 02:46:56 host2 pure-ftpd[42354]: (?@51.161.174.170) [INFO] New connection from 51.161.174.170


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 02:48:28 host2 sshd[43270]: Disconnected from invalid user admin 2.57.121.112 port 37823 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 02:54:28 host2 sshd[47230]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.124.75
country_id: 2921044
description:
Nov 15 03:00:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=159.65.124.75, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0HowtJRDJC2fQXxL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.86
country_id: 3175395
description:
Nov 15 03:03:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=171.22.234.86, lip=66.85.158.91, TLS, session=<PVr8vpRDW+mrFupW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.209
country_id: 3469034
description:
Nov 15 03:03:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.89.136.209, lip=66.85.158.91, TLS, session=<enG5vZRDpZy+WYjR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.116
country_id: 1880251
description:
2025-11-15 03:04:49 dovecot_login authenticator failed for (ADMIN) [156.146.57.116]:8481: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 03:11:05 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64514: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.210.195
country_id: 2077456
description:
2025-11-15 03:21:21 dovecot_login authenticator failed for (ADMIN) [191.101.210.195]:3581: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 15 03:21:29 host2 sshd[65581]: Disconnected from invalid user pilot 85.209.134.43 port 44136 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.57
country_id: 6252001
description:
Nov 15 03:21:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.57, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZvnWAJVDX8zG6xg5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 03:22:13 host2 sshd[66084]: Disconnected from invalid user admin 2.57.121.112 port 53473 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.15
country_id: 2635167
description:
Nov 15 03:22:15 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.15, lip=66.85.158.92, TLS, session=<bAnFApVD1ZdX7LAP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.21
country_id: 2635167
description:
Nov 15 03:22:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.21, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Y83WApVDSdBX7LAV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.33
country_id: 2635167
description:
Nov 15 03:23:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.33, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<H/vQCJVDK+lX7LAh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-15 03:24:01 dovecot_plain authenticator failed for (unhind) [12.150.243.22]:25743: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-15 03:24:01 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:45246: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-11-15 03:24:07 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:57252: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.13
country_id: 2635167
description:
Nov 15 03:23:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.13, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<AqXVBpVDX6NX7LAN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.30
country_id: 2635167
description:
Nov 15 03:24:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.30, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<4I3MCpVDJZ+594ke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.2
country_id: 6252001
description:
2025-11-15 03:25:01 dovecot_plain authenticator failed for ([10.4.2.55]) [209.160.115.2]:49497: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.28
country_id: 2635167
description:
Nov 15 03:25:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.28, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hSXGDJVDI+lX7LAc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.2
country_id: 6252001
description:
2025-11-15 03:25:22 dovecot_plain authenticator failed for ([10.4.2.55]) [209.160.115.2]:55620: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.25
country_id: 2635167
description:
Nov 15 03:25:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.25, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<0mbDDpVDx9u594kZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.20
country_id: 2635167
description:
Nov 15 03:26:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.20, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Cee+EJVDkaO594kU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.5
country_id: 2635167
description:
Nov 15 03:26:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.5, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<6zu4EpVDTddX7LAF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.34
country_id: 2635167
description:
Nov 15 03:27:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=</YSzFJVD6eFX7LAi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.8.19.90
country_id: 6252001
description:
2025-11-15 03:31:03 dovecot_plain authenticator failed for ([172.23.0.4]) [45.8.19.90]:55464: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 03:30:39 host2 sshd[71633]: Disconnected from invalid user user 2.57.121.25 port 16727 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.62
country_id: 953987
description:
Nov 15 03:31:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=102.129.61.62, lip=66.85.158.91, TLS, session=<jxs4IpVDQplmgT0+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.140
country_id: 298795
description:
Nov 15 03:31:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=149.34.211.140, lip=66.85.158.91, TLS, session=<co1zI5VDB76VItOM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 15 03:32:16 host2 sshd[72668]: Disconnected from invalid user intel 85.209.134.43 port 53678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 15 03:35:33 host2 sshd[74741]: Disconnected from invalid user sia 85.209.134.43 port 39072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 15 03:36:41 host2 sshd[75470]: Disconnected from invalid user frappe 85.209.134.43 port 34510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.100
country_id: 2635167
description:
2025-11-15 03:38:39 dovecot_login authenticator failed for (ADMIN) [98.159.234.100]:13621: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.210
country_id: 3469034
description:
Nov 15 03:39:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.130.171.210, lip=66.85.158.91, TLS, session=<yqv1P5VD1oOxgqvS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:39:44 host2 sshd[77365]: Disconnected from invalid user omega 103.86.180.10 port 49465 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.97.204.27
country_id: 798544
description:
Nov 15 03:39:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=217.97.204.27, lip=66.85.158.91, TLS, session=<ZTcZQZVDUoTZYcwb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.125
country_id: 6252001
description:
Nov 15 03:39:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.125, lip=66.85.158.91, TLS: Connection closed, session=<eFL3P5VDarvHLZp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:41:14 host2 sshd[78279]: Disconnected from invalid user asuarez 103.86.180.10 port 36743 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:45:03 host2 sshd[80254]: Disconnected from invalid user test1 103.86.180.10 port 51907 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:47:06 host2 sshd[82678]: Disconnected from invalid user admin 103.86.180.10 port 38170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:49:44 host2 sshd[84965]: Disconnected from invalid user xrdp 103.86.180.10 port 38874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 15 03:50:54 host2 sshd[85946]: Disconnected from invalid user test 37.255.249.201 port 53386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.255.249.201
country_id: 130758
description:
Nov 15 03:52:12 host2 sshd[86879]: Disconnected from invalid user omega 37.255.249.201 port 56396 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.109
country_id: 6252001
description:
Nov 15 03:52:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c/fLb5VDtsGTuYRt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 15 03:54:51 host2 sshd[89528]: Disconnected from invalid user xrdp 37.255.249.201 port 52518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Nov 15 03:56:18 host2 sshd[90771]: Disconnected from invalid user hehongju 35.240.75.51 port 60400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Nov 15 03:57:45 host2 sshd[92070]: Disconnected from invalid user user 35.240.75.51 port 53844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 15 03:57:27 host2 sshd[91788]: Disconnected from invalid user devops 37.255.249.201 port 60862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.61
country_id: 2186224
description:
2025-11-15 04:00:00 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:60340: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-15 03:59:23 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:45544: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.121
country_id: 3469034
description:
Nov 15 04:00:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.120.73.121, lip=66.85.158.91, TLS, session=<WxICipVDHOe7eEl5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.173.196.229
country_id: 130758
description:
Nov 15 04:00:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=178.173.196.229, lip=66.85.158.91, TLS, session=<l1I/i5VDxoSyrcTl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:02:10 host2 sshd[96102]: Disconnected from invalid user gm 89.126.209.230 port 41274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:03:38 host2 sshd[98037]: Disconnected from invalid user vlad 89.126.209.230 port 43028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.203.16
country_id: 2077456
description:
2025-11-15 04:04:28 dovecot_login authenticator failed for (ADMIN) [173.239.203.16]:63023: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 04:06:27 host2 sshd[101066]: Disconnected from invalid user admin 2.57.121.112 port 52703 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.208
country_id: 6252001
description:
Nov 15 04:06:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.208, lip=66.85.158.91, TLS, session=<VvFloJVDduPG6xjQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:08:32 host2 sshd[103603]: Disconnected from invalid user admin 89.126.209.230 port 42176 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 04:09:49 host2 sshd[104975]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Nov 15 04:09:22 host2 sshd[104588]: Disconnected from invalid user teamspeak3 45.78.197.91 port 57692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Nov 15 04:09:38 host2 sshd[104770]: Disconnected from invalid user randy 35.240.75.51 port 42674 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.79.238
country_id: 2921044
description:
Nov 15 04:09:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=64.226.79.238, lip=66.85.158.92, session=<zI92rJVDC8ZA4k/u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.184.19
country_id: 2921044
description:
Nov 15 04:09:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.90.184.19, lip=66.85.158.92, session=</AOErJVDtoakWrgT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:13:26 host2 sshd[109336]: Disconnected from invalid user dummy 193.122.200.89 port 54308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:13:19 host2 sshd[109234]: Disconnected from invalid user odoo13 89.126.209.230 port 41294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:18:20 host2 sshd[114447]: Disconnected from invalid user nominatim 89.126.209.230 port 40448 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.39
country_id: 6252001
description:
Nov 15 04:21:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5TuK1pVDB8rG6xgn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.69.253
country_id: 6252001
description:
Nov 15 04:22:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.69.253, lip=66.85.158.92, session=<omz72JVDxpQtIUX9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:22:08 host2 sshd[119765]: Disconnected from invalid user mike 193.122.200.89 port 52914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Nov 15 04:25:05 host2 sshd[121203]: Disconnected from invalid user user 45.78.197.91 port 48564 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Nov 15 04:25:54 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<V2Bh5pVD+I1HBobn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-11-15 04:26:18 dovecot_plain authenticator failed for (andortomy) [88.149.153.106]:46756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 04:27:46 host2 sshd[123161]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:29:51 host2 sshd[124339]: Disconnected from invalid user kata 193.122.200.89 port 36350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.177
country_id: 3144096
description:
2025-11-15 04:32:23 dovecot_login authenticator failed for (ADMIN) [46.246.122.177]:33542: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:33:47 host2 sshd[126411]: Disconnected from invalid user teamspeak3 193.122.200.89 port 55356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Nov 15 04:34:56 host2 sshd[127006]: Disconnected from invalid user armin 45.78.197.91 port 43992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.226.144
country_id: 2921044
description:
Nov 15 04:37:44 host2 sshd[128636]: Disconnected from invalid user test 91.108.226.144 port 38294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 04:40:03 host2 sshd[129795]: Disconnected from invalid user admin 2.57.121.112 port 9577 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-15 04:41:40 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:33946: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-15 04:42:06 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:37310: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.108.226.144
country_id: 2921044
description:
Nov 15 04:42:59 host2 sshd[131331]: Disconnected from invalid user user 91.108.226.144 port 59642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Nov 15 04:44:36 host2 sshd[132149]: Disconnected from invalid user data 45.78.197.91 port 46622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.247.119
country_id: 1819730
description:
Nov 15 04:45:20 host2 sshd[133202]: Disconnected from invalid user user2 34.92.247.119 port 57794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 15 04:46:07 host2 sshd[133742]: Disconnected from invalid user client 154.16.81.78 port 56152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.247.119
country_id: 1819730
description:
Nov 15 04:46:47 host2 sshd[134225]: Disconnected from invalid user adriano 34.92.247.119 port 59788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 15 04:47:28 host2 sshd[134558]: Disconnected from invalid user adriano 154.16.81.78 port 33160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 15 04:48:46 host2 sshd[135069]: Disconnected from invalid user user123 154.16.81.78 port 36078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:49:30 host2 sshd[135411]: Disconnected from invalid user data 193.122.200.89 port 38186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 04:49:47 host2 sshd[135537]: Disconnected from invalid user test 154.91.170.39 port 42240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-15 04:49:14 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (unspelled) [68.82.141.145]:53752: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 04:51:00 host2 sshd[136333]: Disconnected from invalid user node 64.23.180.137 port 60222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.226.144
country_id: 2921044
description:
Nov 15 04:51:21 host2 sshd[136545]: Disconnected from invalid user user 91.108.226.144 port 45940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 04:52:47 host2 sshd[137172]: Disconnected from invalid user teste1 64.23.180.137 port 54304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.64
country_id: 1814991
description:
2025-11-15 04:52:57 dovecot_login authenticator failed for (ADMIN) [188.241.80.64]:35442: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.177
country_id: 1643084
description:
Nov 15 04:54:40 host2 sshd[138917]: Disconnected from invalid user ubuntu 27.112.78.177 port 47118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 04:55:04 host2 sshd[139181]: Disconnected from invalid user degen 64.23.180.137 port 40898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 04:54:26 host2 sshd[138765]: Disconnected from invalid user user2 154.91.170.39 port 42616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 04:56:25 host2 sshd[139932]: Disconnected from invalid user user 2.57.121.25 port 34588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 04:56:29 host2 sshd[139997]: Disconnected from invalid user degen 154.91.170.39 port 42812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.177
country_id: 1643084
description:
Nov 15 04:56:33 host2 sshd[140012]: Disconnected from invalid user lruiz 27.112.78.177 port 45010 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 15 04:56:45 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<rWu4VJZDwq9HBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 15 04:56:48 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<zQjnVJZD5L1HBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 04:58:42 host2 sshd[141109]: Disconnected from invalid user deepak 154.91.170.39 port 43018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 04:59:23 host2 sshd[141581]: Disconnected from invalid user adminz 64.23.180.137 port 43934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.177
country_id: 1643084
description:
Nov 15 05:00:10 host2 sshd[142168]: Disconnected from invalid user ubuntu 27.112.78.177 port 52012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 05:00:27 host2 sshd[142365]: Disconnected from invalid user test 64.23.180.137 port 50508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 05:01:48 host2 sshd[143354]: Disconnected from invalid user orange 154.91.170.39 port 43340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-15 05:10:52 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (unrous) [217.215.74.195]:48368: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.177
country_id: 1643084
description:
Nov 15 05:12:52 host2 sshd[150217]: Disconnected from invalid user dan 27.112.78.177 port 42446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.18
country_id: 289688
description:
2025-11-15 05:14:43 dovecot_login authenticator failed for (ADMIN) [95.181.234.18]:51124: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 15 05:18:12 host2 sshd[154028]: Disconnected from invalid user mostafa 103.182.132.154 port 44446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.158
country_id: 690791
description:
Nov 15 05:18:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=176.103.2.158, lip=66.85.158.91, TLS, session=<YqGqopZD1qmwZwKe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.154
country_id: 953987
description:
Nov 15 05:19:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.52.154, lip=66.85.158.91, TLS, session=<pZfLo5ZDq7JmgTSa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-11-15 05:20:45 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:43590: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-15 05:21:11 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:51004: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Nov 15 05:21:14 host2 sshd[156240]: Disconnected from invalid user administrator 212.19.117.204 port 44172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.233.191
country_id: 6252001
description:
Nov 15 05:21:53 host2 sshd[156475]: Disconnected from invalid user odoo 192.3.233.191 port 50658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.233.191
country_id: 6252001
description:
Nov 15 05:23:08 host2 sshd[157310]: Disconnected from invalid user paul 192.3.233.191 port 52896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.124.182.133
country_id: 3175395
description:
Nov 15 05:24:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=185.124.182.133, lip=66.85.158.91, TLS, session=<DNZQuZZDzqO5fLaF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.190.142
country_id: 3175395
description:
Nov 15 05:24:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.208.190.142, lip=66.85.158.91, TLS, session=<4BuntZZDNIS50L6O>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 15 05:24:11 host2 sshd[157973]: Disconnected from invalid user admin 103.182.132.154 port 58170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Nov 15 05:24:33 host2 sshd[158183]: Disconnected from invalid user login 212.19.117.204 port 57969 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.226.154.124
country_id: 3469034
description:
Nov 15 05:24:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<587hr>, method=PLAIN, rip=45.226.154.124, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NU/GtpZDzg8t4pp8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 15 05:25:45 host2 sshd[158995]: Disconnected from invalid user syncuser 103.182.132.154 port 57526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-11-15 05:26:47 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (smive) [174.169.224.27]:42634: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-11-15 05:26:51 dovecot_plain authenticator failed for (beschanest) [199.192.123.12]:47550: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.169.255
country_id: 3469034
description:
Nov 15 05:27:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.130.169.255, lip=66.85.158.91, TLS, session=<95MiwpZDD7qxgqn/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.94
country_id: 3469034
description:
Nov 15 05:28:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=177.44.71.94, lip=66.85.158.91, TLS, session=<4/1ow5ZDOKyxLEde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-15 05:29:22 dovecot_plain authenticator failed for (laterees) [154.144.255.209]:57958: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 15 05:36:56 host2 sshd[165781]: Disconnected from invalid user test 103.182.132.154 port 50590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.82
country_id: 2782113
description:
2025-11-15 05:42:46 dovecot_login authenticator failed for (ADMIN) [156.146.60.82]:8792: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 05:43:08 host2 sshd[169137]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-11-15 05:43:44 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:54802: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-15 05:43:59 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:60774: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.213
country_id: 933860
description:
Nov 15 05:44:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=41.216.215.213, lip=66.85.158.91, TLS, session=<Gh1G/pZD85Ip2NfV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.222
country_id: 953987
description:
Nov 15 05:44:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.51.222, lip=66.85.158.91, TLS, session=<LQyR/5ZDvNlmgTPe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:49:16 host2 sshd[173048]: Disconnected from invalid user ramon 195.178.191.5 port 34544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 05:52:24 host2 sshd[174784]: Disconnected from invalid user ramon 50.84.211.204 port 55328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:52:49 host2 sshd[174927]: Disconnected from invalid user test2 195.178.191.5 port 33950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 05:53:32 host2 sshd[175373]: Disconnected from invalid user carol 50.84.211.204 port 54882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 15 05:53:47 host2 sshd[175443]: Disconnected from invalid user koha 134.209.225.104 port 50888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 05:54:40 host2 sshd[176274]: Disconnected from invalid user koha 50.84.211.204 port 54438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:55:11 host2 sshd[176855]: Disconnected from invalid user deploy 195.178.191.5 port 45864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 05:55:49 host2 sshd[177162]: Disconnected from invalid user sduran 50.84.211.204 port 53994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 15 05:55:56 host2 sshd[177191]: Disconnected from invalid user carol 134.209.225.104 port 50512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:56:32 host2 sshd[177621]: Disconnected from invalid user deploy 195.178.191.5 port 44150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.237.115.242
country_id: 1880251
description:
Nov 15 05:56:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.237.115.242, lip=66.85.158.92, session=<B0r8K5dDii4v7XPy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:59:13 host2 sshd[179061]: Disconnected from invalid user wei 195.178.191.5 port 58418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.91
country_id: 3017382
description:
2025-11-15 05:59:34 dovecot_login authenticator failed for (ADMIN) [203.188.183.91]:54158: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 15 06:00:14 host2 sshd[179750]: Disconnected from invalid user lili 134.209.225.104 port 38368 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 06:01:07 host2 sshd[180382]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 06:01:27 host2 sshd[180558]: Disconnected from invalid user admin 50.84.211.204 port 51762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 06:08:10 host2 sshd[184356]: Disconnected from invalid user fredrick 62.60.131.157 port 64711 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-15 06:08:57 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:56832: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-11-15 06:09:31 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:50857: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 06:11:52 host2 sshd[186648]: Disconnected from invalid user admin 2.57.121.112 port 61371 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.168
country_id: 6252001
description:
Nov 15 06:14:47 host2 pure-ftpd[189091]: (?@198.235.24.168) [INFO] New connection from 198.235.24.168


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 06:18:08 host2 sshd[191080]: Disconnected from invalid user admin 2.57.121.112 port 62706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.196
country_id: 298795
description:
Nov 15 06:20:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=95.0.32.196, lip=66.85.158.91, TLS, session=<sSHmfpdDpJxfACDE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.77
country_id: 3175395
description:
Nov 15 06:20:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.124.182.77, lip=66.85.158.91, TLS, session=<4Ob0f5dDgLa5fLZN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.217.112.99
country_id: 798544
description:
Nov 15 06:22:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.217.112.99, lip=66.85.158.91, TLS, session=<fyLzhJdDkZ2y2XBj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.171
country_id: 953987
description:
Nov 15 06:22:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.64.32.171, lip=66.85.158.91, TLS, session=<GS0ThpdD0MhmQCCr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.184
country_id: 1694008
description:
2025-11-15 06:25:24 dovecot_login authenticator failed for (ADMIN) [188.214.125.184]:9573: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.167
country_id: 6252001
description:
Nov 15 06:29:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.167, lip=66.85.158.92, TLS, session=<tOb3oJdD7vjN0h+n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-15 06:37:40 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:52219: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-15 06:38:49 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:57676: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-15 06:39:05 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:46708: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2025-11-15 06:38:28 dovecot_login authenticator failed for ([49.124.153.35]) [49.124.153.35]:59678: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-15 06:39:34 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:35097: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 06:41:04 host2 sshd[203954]: Disconnected from invalid user admin 2.57.121.112 port 9484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-11-15 06:54:31 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:53952: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-11-15 06:54:40 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:56274: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 06:55:26 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49706: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.11
country_id: 953987
description:
Nov 15 06:59:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.53.11, lip=66.85.158.91, TLS, session=<c1rUCJhDWsRmgTUL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.187
country_id: 953987
description:
Nov 15 06:58:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.45.187, lip=66.85.158.91, TLS, session=<WTCIB5hDo+hmQC27>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.227
country_id: 6252001
description:
Nov 15 07:00:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.227, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lKeZEJhDGMXN0h/j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.190.159
country_id: 3175395
description:
Nov 15 07:01:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.208.190.159, lip=66.85.158.91, TLS, session=<SlnoEphD9Mu50L6f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.120.206
country_id: 3469034
description:
Nov 15 07:02:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=186.224.120.206, lip=66.85.158.91, TLS, session=<GK8sFJhDwdS64HjO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.122
country_id: 3865483
description:
Nov 15 07:08:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.11.195.122, lip=66.85.158.91, TLS, session=<fRh2LJhDsqS+C8N6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.189.34
country_id: 3469034
description:
Nov 15 07:09:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=45.179.189.34, lip=66.85.158.91, TLS, session=<BfOyLZhDGMQts70i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 07:14:10 host2 sshd[224501]: Disconnected from invalid user admin 2.57.121.112 port 23691 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.139.234
country_id: 2921044
description:
2025-11-15 07:15:16 dovecot_login authenticator failed for ([144.31.139.234]) [144.31.139.234]:60018: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-11-15 07:15:39 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:60652: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 07:16:34 host2 sshd[225768]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 15 07:21:06 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, TLS: Connection closed, session=<+5n0WJhDhJwz3piW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 15 07:21:11 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<mjA8WZhDlpwz3piW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 07:29:54 host2 sshd[233796]: Disconnected from invalid user user 2.57.121.25 port 11220 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 07:34:34 host2 sshd[236994]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 07:36:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, session=<lMF+kJhDyoG4aYtF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.153
country_id: 6252001
description:
Nov 15 07:36:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.153, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8ECakZhD+f5APsWZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Nov 15 07:37:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<UaGpkphD6K1APsWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.4
country_id: 6252001
description:
Nov 15 07:42:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, session=<HAUNpphDiKfLN4ME>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Nov 15 07:42:53 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.92, TLS, session=<f4/UpphDeuNHBobp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.84
country_id: 6252001
description:
Nov 15 07:49:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.84, lip=66.85.158.91, TLS: Connection closed, session=<L2H3vZhDqNPHLZtU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.28.138
country_id: 1269750
description:
2025-11-15 07:54:45 dovecot_login authenticator failed for ([125.22.221.129]) [125.17.28.138]:53596: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-11-15 07:55:10 dovecot_login authenticator failed for ([103.245.109.37]) [103.245.109.37]:44664: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 07:57:31 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<kOoz25hDGrEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 07:59:11 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Rp0j4ZhDGu4DhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 07:59:34 host2 sshd[252323]: Disconnected from invalid user  2.57.121.112 port 62702 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:00:46 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<bgzN5phDLosDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:01:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<UwMs65hD/M8DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:01:59 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<y5sf65hD+M8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:02:24 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Ba6g7JhDJMcDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:03:35 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<a3Ll8JhDrL0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:03:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<oEwM8ZhDOOoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:04:09 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<X0Ht8phDEqkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:05:44 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<H86N+JhDqL4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.137
country_id: 6252001
description:
Nov 15 08:05:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.137, lip=66.85.158.91, session=<E4dv+ZhDF8DDuEyJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.137
country_id: 6252001
description:
Nov 15 08:06:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.137, lip=66.85.158.91, session=</pEL+phDNcfDuEyJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.139
country_id: 6252001
description:
Nov 15 08:06:17 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.139, lip=66.85.158.91, session=<+POA+phDpZ3DuEyL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.211
country_id: 6252001
description:
Nov 15 08:06:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.211, lip=66.85.158.91, session=<AwWx+phDk57DuEzT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:10:24 host2 sshd[259289]: Disconnected from invalid user ubuntu 103.217.144.65 port 42106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 15 08:11:38 host2 sshd[260142]: Disconnected from invalid user user1 41.111.162.34 port 10020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.8.51
country_id: 2300660
description:
Nov 15 08:12:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.139.8.51, lip=66.85.158.91, TLS, session=</hysEJlDiugpiwgz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.223
country_id: 953987
description:
Nov 15 08:13:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=102.64.39.223, lip=66.85.158.91, TLS, session=<254JEplDyaxmQCff>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.96
country_id: 3624060
description:
2025-11-15 08:14:07 dovecot_login authenticator failed for ([186.177.88.96]) [186.177.88.96]:47975: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:14:22 host2 sshd[261838]: Disconnected from invalid user bitrix 103.217.144.65 port 43960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-11-15 08:14:33 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:51889: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 119.28.107.251 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:16:19 host2 sshd[263094]: Disconnected from invalid user tabata 103.217.144.65 port 54296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 15 08:16:29 host2 sshd[263293]: Disconnected from invalid user parth 41.111.162.34 port 6639 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:19:59 host2 sshd[265350]: Disconnected from invalid user test 103.217.144.65 port 34652 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.88
country_id: 6252001
description:
Nov 15 08:21:32 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.155.88, lip=66.85.158.92, TLS: Connection closed, session=<D/MOMZlDQpzHLZtY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:21:57 host2 sshd[266948]: Disconnected from invalid user mac 103.217.144.65 port 36862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 08:26:13 host2 sshd[269537]: Disconnected from invalid user kurtis 62.60.131.157 port 51482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 15 08:27:41 host2 sshd[270730]: Disconnected from invalid user vlad 177.85.247.230 port 44058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 08:28:29 host2 sshd[271216]: Disconnected from invalid user user 2.57.121.25 port 10072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 15 08:29:11 host2 sshd[271592]: Disconnected from invalid user odoo13 177.85.247.230 port 22974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.32.230.230
country_id: 2635167
description:
2025-11-15 08:31:17 dovecot_plain authenticator failed for uddi-29-b2-v4wan-166599-cust1765.vm12.cable.virginm.net (garamods) [82.32.230.230]:54986: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 15 08:31:53 host2 sshd[273300]: Disconnected from invalid user mahesh 177.85.247.230 port 65222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.152.231
country_id: 690791
description:
Nov 15 08:33:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.221.152.231, lip=66.85.158.91, TLS, session=<gOL7WZlDM6kl3Zjn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.25.132.45
country_id: 1269750
description:
Nov 15 08:33:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=103.25.132.45, lip=66.85.158.91, TLS, session=<bKEaW5lDh+xnGYQt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Nov 15 08:41:46 host2 sshd[280232]: Disconnected from invalid user gm 181.0.192.28 port 1229 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 15 08:43:57 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<X0xCgZlD2MxHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 15 08:43:58 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<0EFKgZlDsM5HBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Nov 15 08:48:23 host2 sshd[286534]: Disconnected from invalid user mahesh 181.0.192.28 port 14066 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.0.192.28
country_id: 3865483
description:
Nov 15 08:50:05 host2 sshd[287639]: Disconnected from invalid user admin 181.0.192.28 port 1979 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 08:50:09 host2 sshd[287700]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 08:54:13 host2 sshd[289069]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Nov 15 08:56:46 host2 sshd[292733]: Disconnected from invalid user kizzy 181.0.192.28 port 7993 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 15 08:59:59 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<bSKMuplDNsWTuYVQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 15 09:00:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zuJ9u5lDQPyTuYVQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-15 09:04:14 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:59388: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-11-15 09:04:32 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:55908: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.49.245.100
country_id: 3469034
description:
Nov 15 09:04:55 host2 sshd[298567]: Disconnected from invalid user hari 201.49.245.100 port 62209 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 15 09:06:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS, session=</fRK0plDWu+TuYVQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 09:08:14 host2 sshd[300661]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.122
country_id: 226074
description:
Nov 15 09:09:25 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=196.0.122.122, lip=66.85.158.91, TLS, session=<OEwC25lDP7jEAHp6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.143.206
country_id: 690791
description:
Nov 15 09:09:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=37.221.143.206, lip=66.85.158.91, TLS, session=<0dVX3JlD7uol3Y/O>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.49.245.100
country_id: 3469034
description:
Nov 15 09:14:00 host2 sshd[305104]: Disconnected from invalid user manager 201.49.245.100 port 63330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 09:14:37 host2 sshd[305676]: Disconnected from invalid user admin 2.57.121.112 port 31585 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-15 09:15:59 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (ureet) [217.215.74.195]:56630: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.49.245.100
country_id: 3469034
description:
Nov 15 09:15:28 host2 sshd[306422]: Disconnected from invalid user feedback 201.49.245.100 port 61843 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.49.245.100
country_id: 3469034
description:
Nov 15 09:18:26 host2 sshd[308521]: Disconnected from invalid user pacific 201.49.245.100 port 62359 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.137.142.246
country_id: 1655842
description:
2025-11-15 09:29:29 dovecot_login authenticator failed for ([202.137.142.246]) [202.137.142.246]:59538: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-15 09:29:35 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:49885: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.222
country_id: 690791
description:
Nov 15 09:29:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.221.147.222, lip=66.85.158.91, TLS, session=<NVg2JJpDv8sl3ZPe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.190.96.234
country_id: 3469034
description:
Nov 15 09:30:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=179.190.96.234, lip=66.85.158.91, TLS, session=<eSxZJZpDBYOzvmDq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.171
country_id: 6252001
description:
Nov 15 09:33:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.171, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<BOpnMppDy9LN0h+r>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-15 09:44:11 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:41312: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 15 09:46:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, TLS: Connection closed, session=<V0ylYJpD4MSUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 09:46:41 host2 sshd[328816]: Disconnected from invalid user  2.57.121.112 port 62524 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.193.226.186
country_id: 6252001
description:
[2025-11-15 09:47:30 +0530] info [whostmgrd] 73.193.226.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 09:47:36 host2 sshd[329344]: Disconnected from invalid user admin 2.57.121.112 port 43681 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 15 09:49:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.91, session=<Z8MGappDINmUcdUX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 09:52:53 host2 sshd[332675]: Disconnected from invalid user  2.57.121.112 port 61580 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 09:53:46 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<497neppDVswjy9Pk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 09:54:36 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<t5jefZpDqOYjy9Pk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 09:55:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<8iNtgJpD7P0jy9Pk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Nov 15 09:55:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS: Connection closed, session=<454LgZpDJNynXpIy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 10:00:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS, session=<LwTskppDavIjy9Pk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 10:01:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS, session=<uhiLlZpDmPEjy9Pk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 15 10:05:20 host2 sshd[341859]: Disconnected from invalid user mamad 185.216.119.134 port 48582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 15 10:06:51 host2 sshd[342675]: Disconnected from invalid user user 185.216.119.134 port 51776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 15 10:08:16 host2 sshd[343500]: Disconnected from invalid user user 185.216.119.134 port 54960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 15 10:12:44 host2 sshd[346509]: Disconnected from invalid user wedding 185.216.119.134 port 36286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-11-15 10:17:23 dovecot_login authenticator failed for 5.185.198.73.ipv4.public.orange.pl [5.185.198.73]:45860: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-15 10:17:16 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:51865: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.135.238
country_id: 99237
description:
Nov 15 10:18:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=65.20.135.238, lip=66.85.158.91, TLS, session=<uRJI0ppDBe1BFIfu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.2.189.96
country_id: 798544
description:
Nov 15 10:18:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=83.2.189.96, lip=66.85.158.91, TLS, session=<QhIt0ZpDtKJTAr1g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.159.7
country_id: 2921044
description:
Nov 15 10:19:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.159.7, lip=66.85.158.92, TLS, session=<K4rZ15pDctOl458H>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.210.106
country_id: 1819730
description:
Nov 15 10:23:10 host2 pure-ftpd[353746]: (?@123.58.210.106) [INFO] New connection from 123.58.210.106


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.210.106
country_id: 1819730
description:
Nov 15 10:25:00 host2 pure-ftpd[354990]: (?@123.58.210.106) [INFO] New connection from 123.58.210.106


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.210.106
country_id: 1819730
description:
Nov 15 10:25:19 host2 pure-ftpd[355410]: (?@123.58.210.106) [INFO] New connection from 123.58.210.106


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 10:31:01 host2 sshd[358995]: Disconnected from invalid user admin 2.57.121.112 port 52439 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 180.75.48.12
country_id: 1733045
description:
Nov 15 10:34:19 host2 sshd[360989]: Disconnecting authenticating user root 180.75.48.12 port 48339: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 180.75.48.12
country_id: 1733045
description:
Nov 15 10:34:19 host2 sshd[360989]: error: maximum authentication attempts exceeded for root from 180.75.48.12 port 48339 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.75.48.12
country_id: 1733045
description:
Nov 15 10:34:41 host2 sshd[361176]: Disconnecting invalid user admin 180.75.48.12 port 49160: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.47.88
country_id: 6252001
description:
2025-11-15 10:38:13 dovecot_plain authenticator failed for ([10.143.41.218]) [143.244.47.88]:56904: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 10:41:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58821: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.87
country_id: 6252001
description:
Nov 15 10:46:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.87, lip=66.85.158.92, session=<UYh6NptDmPuTuYRX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov 15 10:50:54 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.91, session=<cZ84R5tDioCUcd0c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.232
country_id: 6252001
description:
Nov 15 10:53:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.232, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<N9G5UZtDj8DG6xjo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.186.239.214
country_id: 953987
description:
2025-11-15 10:55:26 dovecot_plain authenticator failed for ([31.57.166.48]) [105.186.239.214]:44278: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.217.207.48
country_id: 3996063
description:
2025-11-15 10:55:53 dovecot_plain authenticator failed for ([31.57.166.48]) [189.217.207.48]:52054: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.193.229.3
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.193.229.3 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.163.189.181
country_id: 3996063
description:
2025-11-15 10:56:38 dovecot_plain authenticator failed for ([31.57.166.48]) [164.163.189.181]:38990: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.155.94.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.155.94.28 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.36.17.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.36.17.135 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.9.187.52
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.9.187.52 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.106.220.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.106.220.127 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.133.58
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.175.133.58 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.192.12.59
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.192.12.59 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.143
country_id: 6290252
description:
Nov 15 10:59:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=109.206.98.143, lip=66.85.158.91, TLS, session=<zyOSZZtDt5JtzmKP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.142
country_id: 1269750
description:
Nov 15 10:59:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=103.59.134.142, lip=66.85.158.91, TLS, session=<zwivZZtDar1nO4aO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.48
country_id: 3175395
description:
Nov 15 10:59:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.208.189.48, lip=66.85.158.91, TLS, session=<siGDZJtD2oW50L0w>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.217
country_id: 3865483
description:
Nov 15 10:59:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.181.101.217, lip=66.85.158.91, TLS, session=<i2lmZJtDGcy+tWXZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.252.132.0
country_id: 102358
description:
2025-11-15 11:00:21 dovecot_plain authenticator failed for ([31.57.166.48]) [51.252.132.0]:1050: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.92.253.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.92.253.202 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.48.235.156
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.48.235.156 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.184.47.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.184.47.57 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.96.247.25
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.96.247.25 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.44.144.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.44.144.143 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.170.206.46
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.170.206.46 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.100.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 35.144.100.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.251.191.162
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.251.191.162 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.90.23.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.90.23.111 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.191.28.88
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.191.28.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.232.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.132.232.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.250.100.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.250.100.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.179.6.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 198.179.6.154 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.19
country_id: 2635167
description:
Nov 15 11:02:48 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.19, lip=66.85.158.92, TLS, session=<2k7QcZtDP61X7LAT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 11:03:57 host2 sshd[383187]: Disconnected from invalid user admin 2.57.121.112 port 35129 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.3
country_id: 1880251
description:
Nov 15 11:04:36 host2 sshd[383612]: Disconnected from invalid user shoutcast 45.78.193.3 port 59282 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.185.41.235
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.185.41.235 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.141.122.158
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.141.122.158 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.176.251.233
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 166.176.251.233 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.219.175.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 32.219.175.87 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.39.79.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.39.79.225 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.196.214.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.196.214.35 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.151.134.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.151.134.75 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.3
country_id: 1880251
description:
Nov 15 11:07:15 host2 sshd[385388]: Disconnected from invalid user noel 45.78.193.3 port 40440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.3
country_id: 1880251
description:
Nov 15 11:09:50 host2 sshd[387136]: Disconnected from invalid user nick 45.78.193.3 port 58748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:10:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<n0wDjJtDqukDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.29
country_id: 1819730
description:
Nov 15 11:14:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.29, lip=66.85.158.92, session=<De9VnJtDJC4tjpod>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 15 11:17:46 host2 sshd[394910]: Disconnected from invalid user developer 5.182.83.231 port 59084 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 15 11:20:03 host2 sshd[397028]: Disconnected from invalid user ceo 5.182.83.231 port 48540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-15 11:21:04 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:55192: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-15 11:21:27 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:35564: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.184.226.35
country_id: 3865483
description:
Nov 15 11:21:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=190.184.226.35, lip=66.85.158.91, TLS, session=<U0oxtJtDsMC+uOIj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.216.244.109
country_id: 3469034
description:
2025-11-15 11:21:10 dovecot_plain authenticator failed for ([31.57.166.48]) [186.216.244.109]:53826: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.53.36.78
country_id: 2510769
description:
Nov 15 11:21:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=195.53.36.78, lip=66.85.158.91, TLS, session=<UoAOs5tDsAzDNSRO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.189.80.73
country_id: 2510769
description:
2025-11-15 11:22:43 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:3035: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 15 11:22:20 host2 sshd[398825]: Disconnected from invalid user filippo 5.182.83.231 port 41474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-11-15 11:22:28 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:33462: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.109.62
country_id: 1522867
description:
2025-11-15 11:24:13 dovecot_plain authenticator failed for 37.151.109.62.dynamic.telecom.kz ([31.57.166.48]) [37.151.109.62]:36052: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.0
country_id: 3017382
description:
Nov 15 11:24:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=91.196.152.0, lip=66.85.158.91, session=<PUPiwJtDRYhbxJgA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.3
country_id: 1880251
description:
Nov 15 11:25:09 host2 sshd[400772]: Disconnected from invalid user mohsen 45.78.193.3 port 52896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.81
country_id: 6252001
description:
Nov 15 11:25:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.81, lip=66.85.158.91, TLS: Connection closed, session=<7IoFwptDcBfHLZtR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.90
country_id: 3017382
description:
Nov 15 11:25:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=91.196.152.90, lip=66.85.158.91, session=<RF0RwptDsdlbxJha>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.185.43.134
country_id: 6252001
description:
2025-11-15 11:28:13 dovecot_plain authenticator failed for ([31.57.166.48]) [72.185.43.134]:33112: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-15 11:31:03 dovecot_login authenticator failed for ([201.15.149.254]) [201.15.149.254]:36178: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.208.141.204
country_id: 2245662
description:
2025-11-15 11:30:32 dovecot_plain authenticator failed for ([31.57.166.48]) [41.208.141.204]:51740: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.193.140.76
country_id: 6252001
description:
2025-11-15 11:30:41 dovecot_login authenticator failed for ([71.193.140.76]) [71.193.140.76]:43172: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.84.28.9
country_id: 3865483
description:
2025-11-15 11:36:25 dovecot_plain authenticator failed for ([31.57.166.48]) [181.84.28.9]:55222: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.220.160.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 206.220.160.34 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.10.251.8
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.10.251.8 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.226.161.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.226.161.55 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.135.81.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.135.81.201 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.182.157
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.182.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.75.92.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.75.92.230 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.191.100.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.191.100.147 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.212.242
country_id: 1282988
description:
2025-11-15 11:41:06 dovecot_plain authenticator failed for ([31.57.166.48]) [103.77.212.242]:47502: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.212.242
country_id: 1282988
description:
2025-11-15 11:41:13 dovecot_login authenticator failed for ([31.57.166.48]) [103.77.212.242]:47502: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.126.164.201
country_id: 3469034
description:
2025-11-15 11:43:05 dovecot_plain authenticator failed for ([31.57.166.48]) [179.126.164.201]:62271: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.126.164.201
country_id: 3469034
description:
2025-11-15 11:43:12 dovecot_login authenticator failed for ([31.57.166.48]) [179.126.164.201]:62271: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.202
country_id: 6252001
description:
Nov 15 11:43:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<G1p+BJxDWd7N0h/K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.230.9.42
country_id: 3865483
description:
2025-11-15 11:45:01 dovecot_plain authenticator failed for ([31.57.166.48]) [45.230.9.42]:47938: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.230.9.42
country_id: 3865483
description:
2025-11-15 11:45:08 dovecot_login authenticator failed for ([31.57.166.48]) [45.230.9.42]:47938: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 11:47:20 host2 sshd[418231]: Disconnected from invalid user admin 2.57.121.112 port 7049 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:48:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SrMHFpxDmMYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:49:27 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<gfqeGJxD3usDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:50:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<o+j/GpxDZIsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:51:44 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6SDTIJxDJNADgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 11:51:57 host2 sshd[421441]: Disconnected from invalid user user 2.57.121.25 port 9607 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:53:11 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<4kgBJpxDVugDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 15 11:53:21 host2 sshd[422491]: Disconnected from invalid user bbs 122.166.49.42 port 55716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.250.107
country_id: 798544
description:
Nov 15 11:53:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=109.125.250.107, lip=66.85.158.91, TLS, session=<bilqJ5xDaIZtffpr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.45.200.87
country_id: 2077456
description:
2025-11-15 11:54:14 dovecot_login authenticator failed for ([203.45.200.87]) [203.45.200.87]:60717: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.199.226.121
country_id: 3625428
description:
Nov 15 11:54:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=190.199.226.121, lip=66.85.158.91, TLS, session=<dx+UKJxD7cS+x+J5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:54:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Skv2KZxDVLIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:55:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OiA8LZxD7uMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.1.210.141
country_id: 3686110
description:
2025-11-15 11:56:03 dovecot_plain authenticator failed for ([31.57.166.48]) [179.1.210.141]:59809: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.56.170.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.56.170.87 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.14.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.14.180 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.95.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.37.95.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.15.44.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.15.44.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.58.196.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.58.196.202 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.1.210.141
country_id: 3686110
description:
2025-11-15 11:56:09 dovecot_login authenticator failed for ([31.57.166.48]) [179.1.210.141]:59809: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.55.152.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 143.55.152.89 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 15 11:56:44 host2 sshd[425703]: Disconnected from invalid user schueler 122.166.49.42 port 50092 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:57:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<P64GNpxDZJcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:58:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<PAj3N5xDIpkDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 15 11:58:26 host2 sshd[426915]: Disconnected from invalid user lch 122.166.49.42 port 53014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Nov 15 12:00:24 host2 sshd[428601]: Disconnected from invalid user admin 196.189.237.92 port 38508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:02:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sDNnRpxDoqQDjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.9.107.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.9.107.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.45.26.86
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.45.26.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.64.10.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.64.10.36 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.173.200.109
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.173.200.109 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.106.112.22
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.106.112.22 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.118.183.98
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.118.183.98 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.206.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.4.206.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.127.214.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.127.214.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.55.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.170.55.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.63.163.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.63.163.16 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.145.215
country_id: 6252001
description:
[2025-11-15 12:03:58 +0530] info [whostmgrd] 73.241.145.215 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:03:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AzjvSZxD/q0DjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.70.1.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.70.1.103 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.73.97.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.73.97.138 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.66.69.141
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 207.66.69.141 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:05:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<J3pfUJxD9JYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.18
country_id: 6252001
description:
Nov 15 12:05:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=45.33.109.18, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<qdqcUpxDGM8tIW0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.234.113.143
country_id: 798544
description:
Nov 15 12:05:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=84.234.113.143, lip=66.85.158.91, TLS, session=<TlBAUpxDLAlU6nGP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:05:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1rGhU5xDdNoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.4
country_id: 6252001
description:
Nov 15 12:06:04 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.4, lip=66.85.158.92, TLS, session=<EuEOVJxDHj9C5DUE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.133
country_id: 2300660
description:
Nov 15 12:06:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=41.139.47.133, lip=66.85.158.91, TLS, session=<quNoU5xDbI8piy+F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.103
country_id: 6252001
description:
Nov 15 12:06:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.103, lip=66.85.158.92, TLS, session=<tvOnVZxD6vfG6xhn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 15 12:06:48 host2 sshd[434137]: Disconnected from invalid user system 122.166.49.42 port 39480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:07:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<buW4V5xDwMoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:07:15 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<pUdMWJxDgtgDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov 15 12:08:46 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sKu5XZxD/HjUZija>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:08:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<x+8OXpxDgKoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:09:45 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<11E8YZxD6IEDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.237.92
country_id: 337996
description:
Nov 15 12:10:17 host2 sshd[436862]: Disconnected from invalid user schueler 196.189.237.92 port 34584 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:10:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<VeljZZxDPJoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:11:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<he3vZpxDzMwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:12:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ODm3a5xDQoADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:13:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<UsQBbpxDUMYDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-15 12:15:32 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:13432: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-15 12:15:55 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:40752: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.187.111.18
country_id: 3469034
description:
2025-11-15 12:16:25 dovecot_plain authenticator failed for ([31.57.166.48]) [45.187.111.18]:57571: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.32.95.94
country_id: 6252001
description:
2025-11-15 12:17:33 dovecot_plain authenticator failed for ([31.57.166.48]) [76.32.95.94]:22489: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 12:20:17 host2 sshd[444481]: Disconnected from invalid user admin 2.57.121.112 port 16379 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Nov 15 12:20:23 host2 sshd[444663]: Disconnected from invalid user rstudio 196.189.237.92 port 46008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.195.83.101
country_id: 2510769
description:
2025-11-15 12:21:47 dovecot_plain authenticator failed for ([31.57.166.48]) [213.195.83.101]:8890: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.92.146.190
country_id: 6252001
description:
2025-11-15 12:24:25 dovecot_plain authenticator failed for ([31.57.166.48]) [73.92.146.190]:59602: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Nov 15 12:25:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.92, TLS, session=<rOMHmpxDivSs7OQm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.1.86
country_id: 798544
description:
Nov 15 12:28:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=89.186.1.86, lip=66.85.158.91, TLS, session=<D7KBpJxDP+xZugFW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.185
country_id: 3277605
description:
Nov 15 12:29:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=188.246.73.185, lip=66.85.158.91, TLS, session=<IaSNpZxDMBK89km5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.89.255.228
country_id: 3144096
description:
2025-11-15 12:30:33 dovecot_plain authenticator failed for ti0023a400-5305.bb.online.no ([31.57.166.48]) [88.89.255.228]:61339: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-15 12:32:49 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:44172: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-15 12:33:10 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:55072: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.183.1.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.183.1.36 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.108.3
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.32.108.3 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.153.50.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 164.153.50.72 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.52.228.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.52.228.73 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.235.70.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.235.70.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.172.206.66
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.172.206.66 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.239.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.158.239.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 12:35:41 host2 sshd[456384]: Disconnected from invalid user user 2.57.121.25 port 13834 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.56
country_id: 6252001
description:
Nov 15 12:36:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.56, lip=66.85.158.91, TLS, session=<cagcwpxDwvXN0h84>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.16.149.163
country_id: 1522867
description:
2025-11-15 12:37:00 dovecot_plain authenticator failed for ([31.57.166.48]) [46.16.149.163]:37382: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.16.149.163
country_id: 1522867
description:
2025-11-15 12:37:07 dovecot_login authenticator failed for ([31.57.166.48]) [46.16.149.163]:37382: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 15 12:38:07 host2 sshd[458283]: Disconnected from invalid user admin 50.225.176.238 port 60904 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.84.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.196.84.251 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.97.89.81
country_id: 290557
description:
2025-11-15 12:43:01 dovecot_plain authenticator failed for bba-86-97-89-81.alshamil.net.ae ([31.57.166.48]) [86.97.89.81]:40894: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.103.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.36.103.54 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.22.164
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.202.22.164 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.164.166.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.164.166.123 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.17.116.58
country_id: 2464461
description:
2025-11-15 12:43:57 dovecot_plain authenticator failed for ([31.57.166.48]) [197.17.116.58]:52014: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.97.89.81
country_id: 290557
description:
2025-11-15 12:43:08 dovecot_login authenticator failed for bba-86-97-89-81.alshamil.net.ae ([31.57.166.48]) [86.97.89.81]:40894: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.212.57.192
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.212.57.192 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.169.210.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.169.210.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.181.123.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.181.123.218 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.4.195.208
country_id: 3469034
description:
2025-11-15 12:44:46 dovecot_plain authenticator failed for 201-4-195-208.user3p.veloxzone.com.br ([31.57.166.48]) [201.4.195.208]:45766: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.244.69
country_id: 1282988
description:
2025-11-15 12:44:45 dovecot_plain authenticator failed for ([31.57.166.48]) [103.225.244.69]:2376: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 15 12:45:41 host2 sshd[464933]: Disconnected from invalid user frontend 50.225.176.238 port 35642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 15 12:46:44 host2 sshd[465686]: Disconnected from invalid user ftpuser 50.225.176.238 port 50030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.75.194.50
country_id: 6251999
description:
2025-11-15 12:47:39 dovecot_plain authenticator failed for s0106f85e42ce2a3a.lb.shawcable.net ([31.57.166.48]) [70.75.194.50]:46528: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 15 12:47:48 host2 sshd[466762]: Disconnected from invalid user toto 50.225.176.238 port 42010 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 15 12:49:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, session=<cPyV7pxDXOnG6xhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.201.220.27
country_id: 3017382
description:
2025-11-15 12:49:24 dovecot_plain authenticator failed for 27.220.201.77.rev.sfr.net ([31.57.166.48]) [77.201.220.27]:48972: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.196.125.247
country_id: 3175395
description:
Nov 15 12:49:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=62.196.125.247, lip=66.85.158.91, TLS, session=<pkCM7pxDGbc+xH33>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.53.36.10
country_id: 2510769
description:
Nov 15 12:49:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=195.53.36.10, lip=66.85.158.91, TLS, session=<qMui75xDyp7DNSQK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.114.6.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.114.6.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.191.17.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.191.17.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.126.103.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.126.103.218 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.63.197.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.63.197.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.120.92.153
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.120.92.153 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.72.72.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 206.72.72.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.93.179.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.93.179.18 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.205.220.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.205.220.11 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.222.91.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.222.91.89 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.254.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.90.254.225 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.116.249.115
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.116.249.115 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.173.194.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.173.194.147 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.194.94.71
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.194.94.71 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.204.28.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 97.204.28.195 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.50.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.136.50.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.36.234.192
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.36.234.192 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.172.4.9
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 104.172.4.9 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.248.193.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.248.193.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.221.60.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.221.60.186 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.131.116.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.131.116.252 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.154.170
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.148.154.170 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.66.13.49
country_id: 6252001
description:
2025-11-15 12:57:15 dovecot_plain authenticator failed for ([31.57.166.48]) [216.66.13.49]:35016: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 12:57:19 host2 sshd[474515]: Disconnected from invalid user stephan 62.60.131.157 port 36064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.7.4.194
country_id: 298795
description:
2025-11-15 12:57:22 dovecot_plain authenticator failed for ([31.57.166.48]) [95.7.4.194]:3680: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.244.158.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.244.158.35 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.83.194.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.83.194.111 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.166.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.148.166.207 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.182.247.74
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.182.247.74 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.225.13.131
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.225.13.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.168.18.49
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.168.18.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-15 13:06:36 dovecot_plain authenticator failed for (fulaintrud) [46.8.240.26]:48844: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-15 13:06:39 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (fixes) [73.145.107.251]:52562: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.166.155.166
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 165.166.155.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.110.244.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.110.244.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.53.136.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 38.53.136.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.98.5
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.0.98.5 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.73.103.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.73.103.68 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.9.240.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.9.240.75 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-15 13:13:33 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:37124: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-11-15 13:13:54 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:33554: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.150.253.203
country_id: 6252001
description:
2025-11-15 13:15:58 dovecot_plain authenticator failed for ([31.57.166.48]) [35.150.253.203]:6268: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Nov 15 13:16:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.91, TLS: Connection closed, session=<i3qwTp1DsonCpGsG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 13:20:45 host2 sshd[493055]: Disconnected from invalid user  2.57.121.112 port 62752 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.16.252.86
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.16.252.86 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.4.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.185.4.250 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.76.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.76.217 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.6.132.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.6.132.65 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.228.74
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.149.228.74 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.214.47.23
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.214.47.23 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.11.17
country_id: 798544
description:
Nov 15 13:25:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=89.186.11.17, lip=66.85.158.91, TLS, session=<+AXPb51D8rNZugsR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.197.40
country_id: 2510769
description:
Nov 15 13:25:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=45.135.197.40, lip=66.85.158.91, TLS, session=<+Hq4bp1Dd4sth8Uo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.31.223.170
country_id: 3865483
description:
2025-11-15 13:31:37 dovecot_plain authenticator failed for ([31.57.166.48]) [181.31.223.170]:47158: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.228.242.200
country_id: 3865483
description:
2025-11-15 13:31:45 dovecot_plain authenticator failed for ([31.57.166.48]) [181.228.242.200]:33561: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 15 13:34:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS: Connection closed, session=<1goykJ1DzitChJmH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-15 13:37:04 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:33465: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 13:36:07 host2 sshd[504399]: Disconnected from invalid user admin 2.57.121.112 port 8540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-15 13:36:50 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:57038: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Nov 15 13:40:53 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.55, lip=66.85.158.91, TLS: Connection closed, session=<w/0qp51DvmCnXpI3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.250.111
country_id: 3469034
description:
Nov 15 13:45:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.92.250.111, lip=66.85.158.91, TLS, session=<cjAbuJ1DtrCxXPpv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.207.52.14
country_id: 798544
description:
Nov 15 13:46:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.207.52.14, lip=66.85.158.91, TLS, session=<cz41uZ1Duq5bzzQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.17
country_id: 6252001
description:
Nov 15 13:55:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<IzjG3J1DBOO58uIR>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 13:56:28 host2 sshd[519987]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 15 13:56:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<fQoW4J1DqklChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.95
country_id: 6252001
description:
2025-11-15 14:01:32 dovecot_login authenticator failed for ([70.174.168.95]) [70.174.168.95]:35107: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-15 14:01:53 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:41252: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 34.27.42.6 - fhbhealt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 14:05:22 host2 sshd[527115]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 14:06:28 host2 sshd[527892]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.108
country_id: 6252001
description:
Nov 15 14:11:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.155.108, lip=66.85.158.92, TLS: Connection closed, session=<2zHEE55DhEnHLZts>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 14:12:52 host2 sshd[532952]: Disconnected from invalid user stone 62.60.131.157 port 27818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 14:18:58 host2 sshd[537632]: Disconnected from invalid user admin 2.57.121.112 port 33121 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.46
country_id: 3469034
description:
Nov 15 14:21:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=191.240.37.46, lip=66.85.158.91, TLS, session=<+1ncOJ5D8rm/8CUu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.81
country_id: 732800
description:
Nov 15 14:22:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=185.253.159.81, lip=66.85.158.91, TLS, session=</QwIOp5DoNG5/Z9R>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 14:24:55 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50931: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 15 14:36:00 host2 sshd[551680]: Disconnected from invalid user tatyana 4.211.84.189 port 44072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 15 14:36:45 host2 sshd[552246]: Disconnected from invalid user bill 187.62.87.27 port 44164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.248.192.204
country_id: 1269750
description:
Nov 15 14:39:06 host2 sshd[554502]: Invalid user cloudtourssrilan_travel from 49.248.192.204 port 54486


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:39:51 host2 sshd[555021]: Disconnected from invalid user etq 103.28.57.98 port 30744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 15 14:39:58 host2 sshd[555083]: Disconnected from invalid user tatyana 154.83.15.200 port 57248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 15 14:41:34 host2 sshd[556563]: Disconnected from invalid user tatyana 187.62.87.27 port 39114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 15 14:41:38 host2 sshd[556604]: Disconnected from invalid user code 4.211.84.189 port 44132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Nov 15 14:42:28 host2 sshd[557253]: Disconnected from invalid user bill 196.28.242.198 port 56664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.82
country_id: 3469034
description:
Nov 15 14:42:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.120.72.82, lip=66.85.158.91, TLS, session=<ET5ggp5DWI+7eEhS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.38
country_id: 798544
description:
Nov 15 14:42:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.231.121.38, lip=66.85.158.91, TLS, session=<MZaag55Dzcpb53km>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Nov 15 14:43:14 host2 sshd[557842]: Disconnected from invalid user steam 103.139.59.214 port 43198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Nov 15 14:44:07 host2 sshd[558587]: Disconnected from invalid user steam 196.28.242.198 port 53812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.59.214
country_id: 1269750
description:
Nov 15 14:44:30 host2 sshd[558891]: Disconnected from invalid user bill 103.139.59.214 port 41388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 15 14:45:09 host2 sshd[559574]: Disconnected from invalid user devuser 154.83.15.200 port 56096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 15 14:46:20 host2 sshd[560998]: Disconnected from invalid user rajeev 4.211.84.189 port 36014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Nov 15 14:47:25 host2 sshd[561875]: Disconnected from invalid user jack 196.28.242.198 port 39252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:47:36 host2 sshd[561994]: Disconnected from invalid user song 103.28.57.98 port 53478 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 15 14:47:37 host2 sshd[562010]: Disconnected from invalid user demo 154.83.15.200 port 55510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 15 14:47:12 host2 sshd[561708]: Disconnected from invalid user jack 187.62.87.27 port 42186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 14:51:31 host2 sshd[564870]: Disconnected from invalid user admin 2.57.121.112 port 56680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:52:12 host2 sshd[565440]: Disconnected from invalid user deployer 103.28.57.98 port 46503 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:53:46 host2 sshd[566484]: Disconnected from invalid user steam 103.28.57.98 port 61357 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-11-15 14:54:07 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:58969: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-15 14:54:33 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:50241: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:56:56 host2 sshd[569524]: Disconnected from invalid user admin 103.28.57.98 port 39526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 15:07:49 host2 sshd[578075]: Disconnected from invalid user  2.57.121.112 port 61274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 15:11:24 host2 sshd[580947]: Disconnected from invalid user stone 62.60.131.157 port 17327 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-11-15 15:24:01 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:49633: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.208.55
country_id: 6252001
description:
2025-11-15 15:24:10 dovecot_login authenticator failed for ([216.21.208.55]) [216.21.208.55]:41964: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.76.37.39
country_id: 6252001
description:
[2025-11-15 15:26:58 +0530] info [cpaneld] 148.76.37.39 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.78.140.132
country_id: 6252001
description:
[2025-11-15 15:26:30 +0530] info [cpaneld] 74.78.140.132 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.132.74.210
country_id: 6252001
description:
[2025-11-15 15:26:46 +0530] info [cpaneld] 35.132.74.210 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.153.95
country_id: 6252001
description:
[2025-11-15 15:26:48 +0530] info [whostmgrd] 23.243.153.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.18.211.63
country_id: 6252001
description:
[2025-11-15 15:26:53 +0530] info [cpaneld] 70.18.211.63 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.136.238.55
country_id: 6252001
description:
[2025-11-15 15:26:56 +0530] info [cpaneld] 71.136.238.55 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.189.247.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.189.247.209 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.137.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.111.137.13 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.36.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.150.36.214 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.187.170.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 184.187.170.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.129.130.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.129.130.219 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.217.160.5
country_id: 390903
description:
2025-11-15 15:31:49 dovecot_plain authenticator failed for ([31.57.166.48]) [31.217.160.5]:17959: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.180.162
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.148.180.162 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.103.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.48.103.48 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.246.120.138
country_id: 3469034
description:
2025-11-15 15:32:25 dovecot_plain authenticator failed for ([31.57.166.48]) [170.246.120.138]:6592: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.49.89.39
country_id: 1694008
description:
Nov 15 15:32:44 host2 sshd[597259]: Disconnected from invalid user wireguard 161.49.89.39 port 41340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.116.0.248
country_id: 6252001
description:
2025-11-15 15:33:14 dovecot_plain authenticator failed for c-73-116-0-248.hsd1.ca.comcast.net ([31.57.166.48]) [73.116.0.248]:41242: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 15:34:42 host2 sshd[598458]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 15:34:20 host2 sshd[598243]: Disconnected from invalid user admin 2.57.121.112 port 50802 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.49.89.39
country_id: 1694008
description:
Nov 15 15:38:39 host2 sshd[601328]: Disconnected from invalid user admin 161.49.89.39 port 54162 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.84.5.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.84.5.4 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.230.5.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.230.5.188 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.155.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.155.26 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.187.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.187.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.85.34.172
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.85.34.172 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.140.2.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.140.2.207 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.77.126.249
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.77.126.249 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.49.89.39
country_id: 1694008
description:
Nov 15 15:40:07 host2 sshd[602462]: Disconnected from invalid user filezilla 161.49.89.39 port 57358 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.75.72.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.75.72.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.93.157.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.93.157.219 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.164.134.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.164.134.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.142.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.9.142.201 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.3.79.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.3.79.92 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.103.206.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.103.206.80 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.12.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.39.12.135 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.29
country_id: 6252001
description:
Nov 15 15:42:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.29, lip=66.85.158.92, session=<hOajWp9DnIgs3Lkd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.253.6.231
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.253.6.231 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.121.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 216.26.121.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.233.175.70
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.233.175.70 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.53.148.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.53.148.79 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.179.70.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.179.70.26 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.224.145.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.224.145.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.217.2.228
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 206.217.2.228 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 15:44:39 host2 sshd[605602]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-15 15:47:57 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:43451: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-11-15 15:48:28 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:52148: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.39.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.51.39.6 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.92.162.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.92.162.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.183.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.132.183.217 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.56.18.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.56.18.51 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.130.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.130.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.28.43.76
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 96.28.43.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.162.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.150.162.143 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.150
country_id: 3175395
description:
Nov 15 15:57:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=217.26.179.150, lip=66.85.158.91, TLS, session=<OfYRjZ9DidDZGrOW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.149
country_id: 953987
description:
Nov 15 15:57:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.64.34.149, lip=66.85.158.91, TLS, session=<IYA6jp9DcrBmQCKV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.247.93
country_id: 1733045
description:
2025-11-15 15:57:49 dovecot_plain authenticator failed for ([31.57.166.48]) [182.62.247.93]:43434: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.176.105.48
country_id: 3469034
description:
2025-11-15 16:00:46 dovecot_plain authenticator failed for ([31.57.166.48]) [45.176.105.48]:6485: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.155
country_id: 6252001
description:
Nov 15 16:04:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.155, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ekO8qZ9DaM4s3Lyb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.102.159.188
country_id: 3175395
description:
Nov 15 16:04:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=62.102.159.188, lip=66.85.158.91, TLS, session=<sOYPqZ9DXM4+Zp+8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.204.148
country_id: 294640
description:
2025-11-15 16:05:04 dovecot_plain authenticator failed for ([31.57.166.48]) [147.235.204.148]:4779: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.80
country_id: 3469034
description:
Nov 15 16:04:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.246.80, lip=66.85.158.91, TLS, session=<VUL3p59DC+m60fZQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.204.148
country_id: 294640
description:
2025-11-15 16:05:11 dovecot_login authenticator failed for ([31.57.166.48]) [147.235.204.148]:4779: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.208
country_id: 2635167
description:
Nov 15 16:05:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.208, lip=66.85.158.92, TLS handshaking: Connection closed, session=<K/3PrZ9D4+pX7LDQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.63
country_id: 2635167
description:
Nov 15 16:05:54 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.63, lip=66.85.158.92, TLS, session=<JtzBrZ9Dec6594k/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.202
country_id: 2635167
description:
Nov 15 16:07:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KPXGsZ9Dxbe594nK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.30.127.249
country_id: 6252001
description:
2025-11-15 16:07:03 dovecot_plain authenticator failed for ([31.57.166.48]) [199.30.127.249]:58395: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.205
country_id: 2635167
description:
Nov 15 16:06:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.205, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YX3Lr59DY62594nN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 16:06:59 host2 sshd[622777]: Disconnected from invalid user admin 2.57.121.112 port 50709 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.30.127.249
country_id: 6252001
description:
2025-11-15 16:07:09 dovecot_login authenticator failed for ([31.57.166.48]) [199.30.127.249]:58395: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.204
country_id: 2635167
description:
Nov 15 16:07:34 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.204, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<lYbCs59Ds61X7LDM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.198
country_id: 2635167
description:
Nov 15 16:08:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.198, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<2NG9tZ9DratX7LDG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.208
country_id: 2635167
description:
Nov 15 16:08:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.208, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fCC3t59Dh4G594nQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.40.240.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.40.240.34 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.106.237.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.106.237.77 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.45.197.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.45.197.35 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.247.37.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 63.247.37.60 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.204
country_id: 2635167
description:
Nov 15 16:09:47 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.204, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<hu2vu59DYZxX7LDM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.212
country_id: 2635167
description:
Nov 15 16:09:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.212, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<XmC0uZ9D7ci594nU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.238.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.238.102 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.246.170.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.246.170.178 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.213
country_id: 2635167
description:
Nov 15 16:10:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<3ESpvZ9DL+W594nV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.195
country_id: 2635167
description:
Nov 15 16:10:54 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<iqCkv59Du+JX7LDD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.34.101.182
country_id: 3469034
description:
2025-11-15 16:12:59 dovecot_plain authenticator failed for ([31.57.166.48]) [187.34.101.182]:35662: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.125
country_id: 3469034
description:
Nov 15 16:16:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=186.209.248.125, lip=66.85.158.91, TLS, session=<b9ut0Z9DV6q60fh9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.95
country_id: 3469034
description:
Nov 15 16:16:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=191.240.36.95, lip=66.85.158.91, TLS, session=<OAHa0p9DaJO/8CRf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.33.45.209
country_id: 6252001
description:
2025-11-15 16:17:43 dovecot_plain authenticator failed for ([31.57.166.48]) [47.33.45.209]:58990: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.104.224.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.104.224.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.10.228.165
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.10.228.165 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.207.116.157
country_id: 2635167
description:
2025-11-15 16:19:04 dovecot_plain authenticator failed for gamma.climatec-windows.co.uk (unktain) [92.207.116.157]:47863: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.18.93.167
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.18.93.167 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.7.100.81
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.7.100.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.102.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 12.74.102.16 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.203.36.42
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.203.36.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.113.191.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.113.191.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.244.49.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.244.49.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.203.30.224
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.203.30.224 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.24.236.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.24.236.102 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.56.214.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.56.214.64 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.15.156.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 184.15.156.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.109.153
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.175.109.153 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.122.203.90
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.122.203.90 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.240.185
country_id: 289688
description:
2025-11-15 16:21:48 dovecot_plain authenticator failed for ([31.57.166.48]) [37.210.240.185]:43923: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 16:22:37 host2 sshd[633869]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.116.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.164.116.176 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.184.137.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.184.137.55 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.93.42.27
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.93.42.27 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.136.226.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 40.136.226.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.135.148.240
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.135.148.240 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.97.235
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.207.97.235 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.36.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.150.36.214 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.74.222.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.74.222.105 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.82
country_id: 3469034
description:
Nov 15 16:25:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.120.72.82, lip=66.85.158.91, TLS, session=<jGbH8p9Dp7W7eEhS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.133.16.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.133.16.67 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.181
country_id: 3175395
description:
Nov 15 16:25:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.169.181, lip=66.85.158.91, TLS, session=<74EN9J9Dv6W5D6m1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.94.220.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.94.220.84 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.96.88.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.96.88.243 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.171.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.4.171.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.85.96.58
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 69.85.96.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.135.223.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.135.223.54 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.215.163.118
country_id: 1269750
description:
2025-11-15 16:32:47 dovecot_plain authenticator failed for ([31.57.166.48]) [106.215.163.118]:29278: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.93.247
country_id: 6252001
description:
2025-11-15 16:33:07 dovecot_login authenticator failed for (XYxSEM4Wod) [107.175.93.247]:63885: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.93.247
country_id: 6252001
description:
2025-11-15 16:33:14 dovecot_login authenticator failed for (ndfA6BNE) [107.175.93.247]:64175: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.156.218.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.156.218.238 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.251.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.154.251.121 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.213.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.80.213.21 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.32.20.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.32.20.238 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.9.22.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 216.9.22.116 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.88.87.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.88.87.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.162.78.136
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.162.78.136 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.93.247
country_id: 6252001
description:
2025-11-15 16:37:00 dovecot_login authenticator failed for (7RKtOLFB7o) [107.175.93.247]:54091: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.60
country_id: 953987
description:
Nov 15 16:39:25 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.129.57.60, lip=66.85.158.91, TLS, session=<vR2HJKBDK7dmgTk8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.221.148.85
country_id: 3469034
description:
Nov 15 16:39:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=131.221.148.85, lip=66.85.158.91, TLS, session=<2erEJaBD6rCD3ZRV>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.202.151.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.202.151.100 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.50.23.185
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.50.23.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.131.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.176.131.40 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.13.107
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 38.43.13.107 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.24.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.80.24.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.204.115.185
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.204.115.185 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.222.18.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.222.18.134 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.83.88.249
country_id: 6252001
description:
2025-11-15 16:53:28 dovecot_plain authenticator failed for ec2-54-83-88-249.compute-1.amazonaws.com (EC2AMAZ-H0DP7I4.ec2.internal) [54.83.88.249]:50678: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.30.15
country_id: 99237
description:
2025-11-15 16:53:20 dovecot_plain authenticator failed for ([31.57.166.48]) [185.106.30.15]:18525: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.139.134.157
country_id: 6252001
description:
[2025-11-15 16:55:34 +0530] info [cpaneld] 75.139.134.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.131.234
country_id: 6252001
description:
[2025-11-15 16:55:42 +0530] info [cpaneld] 204.111.131.234 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.132.64.249
country_id: 6252001
description:
[2025-11-15 16:55:44 +0530] info [cpaneld] 72.132.64.249 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.100.96.40
country_id: 6252001
description:
[2025-11-15 16:55:56 +0530] info [cpaneld] 73.100.96.40 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.183.16.79
country_id: 6252001
description:
[2025-11-15 16:55:47 +0530] info [whostmgrd] 67.183.16.79 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.203.78.126
country_id: 6252001
description:
[2025-11-15 16:55:49 +0530] info [cpaneld] 73.203.78.126 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.183.172
country_id: 6252001
description:
[2025-11-15 16:55:52 +0530] info [cpaneld] 67.188.183.172 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.52
country_id: 798544
description:
2025-11-15 16:57:32 dovecot_login authenticator failed for (mgabCJKh) [45.80.158.52]:56162: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.154.8
country_id: 6252001
description:
[2025-11-15 16:57:57 +0530] info [cpaneld] 76.141.154.8 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.246.212.156
country_id: 6252001
description:
[2025-11-15 16:58:00 +0530] info [cpaneld] 96.246.212.156 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.49.246.141
country_id: 6252001
description:
[2025-11-15 16:58:04 +0530] info [cpaneld] 72.49.246.141 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.70.204.73
country_id: 6252001
description:
[2025-11-15 16:58:06 +0530] info [whostmgrd] 97.70.204.73 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.52
country_id: 798544
description:
2025-11-15 16:58:10 dovecot_login authenticator failed for (jRv7jDhWN) [45.80.158.52]:49870: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.141.66.236
country_id: 6252001
description:
[2025-11-15 16:58:11 +0530] info [cpaneld] 35.141.66.236 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.81.199
country_id: 6252001
description:
[2025-11-15 16:58:14 +0530] info [cpaneld] 47.149.81.199 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.36.211.194
country_id: 6252001
description:
[2025-11-15 16:58:16 +0530] info [cpaneld] 199.36.211.194 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 16:58:26 host2 sshd[663876]: Disconnected from invalid user arely 62.60.131.157 port 53756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 17:00:58 host2 sshd[665846]: Disconnected from invalid user administrator 2.57.121.112 port 62411 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.52
country_id: 798544
description:
2025-11-15 17:01:30 dovecot_login authenticator failed for (KP0f5iIu52) [45.80.158.52]:55347: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.204
country_id: 6252001
description:
Nov 15 17:17:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.204, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UtnHraBD1rgUQcHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.137.127
country_id: 3144096
description:
2025-11-15 17:18:52 dovecot_login authenticator failed for (cm-178.232.137.127.get.no) [178.232.137.127]:42740: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.90.196.70
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.90.196.70 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.229.88
country_id: 3865483
description:
2025-11-15 17:19:42 dovecot_login authenticator failed for ([190.185.229.88]) [190.185.229.88]:45962: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-15 17:20:50 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:43838: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-15 17:20:57 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:59690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 17:22:52 host2 sshd[681298]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.25
country_id: 3865483
description:
Nov 15 17:23:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=181.191.223.25, lip=66.85.158.91, TLS, session=<ko/Ew6BD19W1v98Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.42.52
country_id: 2395170
description:
Nov 15 17:24:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=154.127.42.52, lip=66.85.158.91, TLS, session=<KVgGxaBDgp+afyo0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.56.179
country_id: 6252001
description:
Nov 15 17:40:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.221.56.179, lip=66.85.158.91, session=<obgk/6BDyKAU3Tiz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.85.171.68
country_id: 732800
description:
Nov 15 17:42:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=77.85.171.68, lip=66.85.158.91, TLS, session=<68DeB6FD+rdNVatE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.16
country_id: 3469034
description:
Nov 15 17:43:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=177.130.168.16, lip=66.85.158.91, TLS, session=<xkgWCaFD1tSxgqgQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.113.68
country_id: 6252001
description:
Nov 15 17:44:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.113.68, lip=66.85.158.92, session=<AW+ADaFDttasynFE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-15 17:46:06 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (deoly) [81.225.30.107]:38983: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.174.225.60
country_id: 6252001
description:
Nov 15 17:51:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.174.225.60, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<n3WJKKFDnLKsruE8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 15 17:53:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<EPRMMKFDev/CpRCn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.173.54
country_id: 6252001
description:
Nov 15 17:56:55 host2 pure-ftpd[706097]: (?@134.209.173.54) [INFO] New connection from 134.209.173.54


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.209.173.54
country_id: 6252001
description:
Nov 15 17:57:02 host2 pure-ftpd[706187]: (?@134.209.173.54) [INFO] New connection from 134.209.173.54


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.254.229.191
country_id: 3686110
description:
Nov 15 17:56:12 host2 sshd[705784]: Disconnected from invalid user himanshu 170.254.229.191 port 59104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 17:58:26 host2 sshd[707086]: Disconnected from invalid user git 172.210.69.152 port 35850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.27.134.52
country_id: 1168579
description:
Nov 15 17:59:05 host2 sshd[707864]: Disconnected from invalid user yyy 58.27.134.52 port 33896 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.254.229.191
country_id: 3686110
description:
Nov 15 18:00:40 host2 sshd[709055]: Disconnected from invalid user user 170.254.229.191 port 42748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 18:01:02 host2 sshd[709386]: Disconnected from invalid user opc 172.210.69.152 port 57762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 15 18:02:04 host2 sshd[710138]: Disconnected from invalid user seekcy 152.32.185.214 port 51108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 18:02:24 host2 sshd[710316]: Disconnected from invalid user wf 172.210.69.152 port 48382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 15 18:03:23 host2 sshd[711275]: Disconnected from invalid user newuser 152.32.185.214 port 43758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.254.229.191
country_id: 3686110
description:
Nov 15 18:03:30 host2 sshd[711319]: Disconnected from invalid user pivpn 170.254.229.191 port 40870 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.180.96
country_id: 2921044
description:
Nov 15 18:03:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.197.180.96, lip=66.85.158.91, session=<UlO9UqFDdrWKxbRg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.156
country_id: 3865483
description:
Nov 15 18:04:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=181.118.183.156, lip=66.85.158.91, TLS, session=<G0MmU6FD1+O1drec>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.72.212
country_id: 2921044
description:
Nov 15 18:03:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.72.212, lip=66.85.158.91, session=<Y7yIUqFD9SBEt0jU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.95
country_id: 3057568
description:
Nov 15 18:03:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=91.226.115.95, lip=66.85.158.91, TLS, session=<EYj3UaFD1r1b4nNf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 18:03:47 host2 sshd[711492]: Disconnected from invalid user postmaster 172.210.69.152 port 54014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 18:05:17 host2 sshd[712327]: Disconnected from invalid user tarun 172.210.69.152 port 54494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 15 18:08:52 host2 sshd[714165]: Disconnected from invalid user web 152.32.185.214 port 42306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 15 18:11:54 host2 sshd[715819]: Disconnected from invalid user kodi 152.32.185.214 port 38808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 18:13:41 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65489: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:20:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<MkBmjaFDLJwDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:22:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<YJb0lKFDQtoDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:24:19 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<S4jNnKFDULMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:26:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<6SfvoqFDTKADg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 18:26:21 host2 sshd[724209]: Disconnected from invalid user user 2.57.121.25 port 39715 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:26:29 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<BAOGpKFDpLEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:29:50 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<NTuAsKFDnL8Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.46.17
country_id: 6251999
description:
2025-11-15 18:33:35 dovecot_login authenticator failed for dhcp-b8-94-70-ce-5f-c4.cpe.i-zoom.net [24.137.46.17]:44418: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.15.27.17
country_id: 6252001
description:
Nov 15 18:34:06 host2 sshd[729073]: Disconnected from invalid user teamspeak3 20.15.27.17 port 35422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.19
country_id: 1880251
description:
Nov 15 18:35:05 host2 sshd[729745]: Disconnected from invalid user amir 45.78.198.19 port 37480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.19
country_id: 1880251
description:
Nov 15 18:37:46 host2 sshd[731368]: Disconnected from invalid user systemd 45.78.198.19 port 53912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 18:40:56 host2 sshd[733286]: Disconnected from invalid user kaia 62.60.131.157 port 60220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.19
country_id: 1880251
description:
Nov 15 18:40:29 host2 sshd[733063]: Disconnected from invalid user ec2-user 45.78.198.19 port 42754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-15 18:40:33 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:37137: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-15 18:40:47 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:58127: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 18:51:36 host2 sshd[739633]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 18:52:32 host2 sshd[740043]: Disconnected from invalid user admin 2.57.121.112 port 52028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.15.27.17
country_id: 6252001
description:
Nov 15 18:57:29 host2 sshd[743606]: Disconnected from invalid user yanghui 20.15.27.17 port 49022 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 19:01:41 host2 sshd[746107]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.15.27.17
country_id: 6252001
description:
Nov 15 19:01:45 host2 sshd[746135]: Disconnected from invalid user backup 20.15.27.17 port 41010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.76.137
country_id: 3469034
description:
Nov 15 19:01:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.72.76.137, lip=66.85.158.91, TLS, session=<5Vn/IaJDC6+xSEyJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.223
country_id: 3469034
description:
Nov 15 19:02:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=177.44.96.223, lip=66.85.158.91, TLS, session=<erczI6JDptaxLGDf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.15.27.17
country_id: 6252001
description:
Nov 15 19:03:16 host2 sshd[747340]: Disconnected from invalid user ftpuser 20.15.27.17 port 58380 [preauth]


