# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 12:35:01 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:37840: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.160.113.134
country_id: 6252001
description:
[2025-12-23 12:37:56 +0530] info [cpaneld] 67.160.113.134 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 12:37:38 host2 pure-ftpd[626174]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.154.35
country_id: 6252001
description:
[2025-12-23 12:37:49 +0530] info [cpaneld] 35.150.154.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.92.193
country_id: 6252001
description:
[2025-12-23 12:37:53 +0530] info [cpaneld] 47.32.92.193 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.153.13.111
country_id: 6252001
description:
[2025-12-23 12:37:55 +0530] info [cpaneld] 63.153.13.111 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.255.176
country_id: 6252001
description:
[2025-12-23 12:37:47 +0530] info [cpaneld] 129.222.255.176 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.41.184
country_id: 6252001
description:
[2025-12-23 12:37:50 +0530] info [cpaneld] 73.92.41.184 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.145.179.89
country_id: 6252001
description:
[2025-12-23 12:37:51 +0530] info [whostmgrd] 47.145.179.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.67.26.55
country_id: 6252001
description:
[2025-12-23 12:43:42 +0530] info [cpaneld] 173.67.26.55 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.213.164.108
country_id: 6252001
description:
[2025-12-23 12:43:44 +0530] info [cpaneld] 98.213.164.108 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.250.228.152
country_id: 6252001
description:
[2025-12-23 12:43:37 +0530] info [cpaneld] 73.250.228.152 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.124.74.226
country_id: 6252001
description:
[2025-12-23 12:43:38 +0530] info [cpaneld] 76.124.74.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.213.22.86
country_id: 6252001
description:
[2025-12-23 12:43:40 +0530] info [cpaneld] 72.213.22.86 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.239.192.142
country_id: 6252001
description:
[2025-12-23 12:43:41 +0530] info [whostmgrd] 73.239.192.142 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.185.250.99
country_id: 6252001
description:
[2025-12-23 12:43:43 +0530] info [cpaneld] 24.185.250.99 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.94.203.35
country_id: 3469034
description:
Dec 23 12:47:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.94.203.35, lip=66.85.158.91, TLS, session=<sHJkU5lG0qGKXssj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.74.181.139
country_id: 130758
description:
Dec 23 12:46:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=94.74.181.139, lip=66.85.158.91, TLS, session=<ckowUplGHd1eSrWL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-23 12:49:03 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:45506: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-23 12:49:27 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:60968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.22.170
country_id: 192950
description:
Dec 23 12:56:16 host2 sshd[642342]: Invalid user cloudtourssrilan_travel from 102.220.22.170 port 48682


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.39
country_id: 798544
description:
Dec 23 12:57:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.228.32.39, lip=66.85.158.91, TLS, session=<kEepeJlGYYtb5CAn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.233
country_id: 3469034
description:
Dec 23 12:57:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=179.189.201.233, lip=66.85.158.91, TLS, session=<aqTCeZlG5uGzvcnp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-23 12:57:48 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:42850: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-23 12:58:18 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:12470: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-23 13:00:36 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:50007: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-23 13:01:01 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:50113: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:01:15 host2 sshd[646339]: Disconnected from invalid user team1 186.30.115.187 port 40792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:03:13 host2 sshd[647611]: Disconnected from invalid user cosmos 186.30.115.187 port 38086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:03:55 host2 sshd[648190]: Disconnected from invalid user none 186.30.115.187 port 50214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:05:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<VFPClplGbNMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:06:59 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<9cXnm5lGcMUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:08:44 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<wbcfoplGoOIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-23 13:09:03 dovecot_login authenticator failed for H=([125.17.182.121]) [182.95.224.62]:34896: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-23 13:09:14 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:48338: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:10:16 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<d9ijp5lGSsoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:10:31 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<7JyLqJlG9L8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:11:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<PaZgrZlGKtADhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:12:00 host2 dovecot[3805015]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<LsHVrZlGjLgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-23 13:13:26 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:51728: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-23 13:14:06 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:60738: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:14:17 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<xzX6tZlGyMQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:14:34 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<QWkCt5lGhKoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-23 13:15:17 dovecot_login authenticator failed for H=([152.52.231.202]) [152.52.231.202]:59432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-23 13:15:58 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:45016: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-23 13:16:31 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:46831: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-23 13:18:45 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:49000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.194.197
country_id: 3175395
description:
Dec 23 13:19:19 host2 sshd[660748]: Disconnected from invalid user ocadmin 151.44.194.197 port 9335 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.44.194.197
country_id: 3175395
description:
Dec 23 13:21:46 host2 sshd[662716]: Disconnected from invalid user client 151.44.194.197 port 9509 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.103.188.111
country_id: 6252001
description:
[2025-12-23 13:24:06 +0530] info [cpaneld] 76.103.188.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.48.200.40
country_id: 6252001
description:
[2025-12-23 13:24:08 +0530] info [cpaneld] 73.48.200.40 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.185.10.248
country_id: 6252001
description:
[2025-12-23 13:24:10 +0530] info [whostmgrd] 67.185.10.248 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.63.197.20
country_id: 6252001
description:
[2025-12-23 13:24:13 +0530] info [cpaneld] 99.63.197.20 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.199.187.196
country_id: 6252001
description:
[2025-12-23 13:24:15 +0530] info [cpaneld] 161.199.187.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.204
country_id: 1733045
description:
2025-12-23 13:23:36 dovecot_login authenticator failed for H=([49.124.149.204]) [49.124.149.204]:52810: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.87.252.56
country_id: 6252001
description:
[2025-12-23 13:24:03 +0530] info [cpaneld] 76.87.252.56 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.197.30.247
country_id: 6252001
description:
[2025-12-23 13:24:12 +0530] info [cpaneld] 76.197.30.247 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-12-23 13:24:10 dovecot_login authenticator failed for H=(201.173.92.100-clientes-izzi.mx) [201.173.92.100]:55299: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-23 13:25:50 dovecot_login authenticator failed for H=(cm-178.232.240.121.get.no) [178.232.240.121]:39500: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.242.241.133
country_id: 6252001
description:
[2025-12-23 13:25:57 +0530] info [cpaneld] 69.242.241.133 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.176.11.232
country_id: 6252001
description:
[2025-12-23 13:25:58 +0530] info [cpaneld] 98.176.11.232 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.241.90.115
country_id: 6252001
description:
[2025-12-23 13:26:07 +0530] info [cpaneld] 75.241.90.115 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.165.139
country_id: 6252001
description:
[2025-12-23 13:25:39 +0530] info [cpaneld] 209.50.165.139 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.138.176.146
country_id: 6252001
description:
[2025-12-23 13:26:01 +0530] info [whostmgrd] 66.138.176.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.204.60.117
country_id: 6252001
description:
[2025-12-23 13:26:00 +0530] info [cpaneld] 73.204.60.117 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.80.132.91
country_id: 6252001
description:
[2025-12-23 13:26:06 +0530] info [cpaneld] 71.80.132.91 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.213.28.165
country_id: 6252001
description:
[2025-12-23 13:26:09 +0530] info [cpaneld] 71.213.28.165 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-23 13:26:15 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:37486: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 13:27:26 host2 sshd[667114]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.233.156.64
country_id: 1269750
description:
Dec 23 13:27:43 host2 sshd[667292]: Disconnected from invalid user stack 13.233.156.64 port 36250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 23 13:27:53 host2 sshd[667398]: Disconnected from invalid user bb 158.69.210.167 port 41440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.233.156.64
country_id: 1269750
description:
Dec 23 13:28:57 host2 sshd[668093]: Disconnected from invalid user hadoopuser 13.233.156.64 port 39152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 23 13:28:57 host2 sshd[668145]: Disconnected from invalid user itadmin 158.69.210.167 port 37190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-12-23 13:29:13 dovecot_login authenticator failed for H=(126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:54790: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 23 13:28:29 host2 sshd[667801]: Disconnected from invalid user hadoopuser 129.226.150.85 port 60344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-23 13:29:29 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:56068: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.153
country_id: 1733045
description:
2025-12-23 13:32:03 dovecot_login authenticator failed for H=([49.124.152.153]) [49.124.152.153]:40744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:32:27 host2 sshd[671342]: Disconnected from invalid user clare 20.123.146.92 port 12126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-12-23 13:32:30 dovecot_login authenticator failed for H=(31-154-122-202.orange.net.il) [2.55.122.202]:54312: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Dec 23 13:33:24 host2 sshd[672032]: Disconnected from invalid user debian 20.123.146.93 port 60626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.22.170
country_id: 192950
description:
Dec 23 13:34:29 host2 sshd[672924]: Invalid user cloudtourssrilan_travel from 102.220.22.170 port 50524


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:36:24 host2 sshd[674463]: Disconnected from invalid user julio 20.123.146.92 port 64566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-12-23 13:37:50 dovecot_login authenticator failed for H=([102.214.44.117]) [102.214.44.117]:49586: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:37:31 host2 sshd[675217]: Disconnected from invalid user practice 20.123.146.92 port 65055 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-23 13:38:28 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:59306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 13:39:05 host2 pure-ftpd[676501]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:39:47 host2 sshd[676881]: Disconnected from invalid user backupuser 20.123.146.92 port 55906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 23 13:42:06 host2 sshd[678948]: Disconnected from invalid user qa 4.210.186.201 port 31886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-23 13:43:11 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:45408: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 23 13:43:39 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, session=<Wez8HppGrqJChJmM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-23 13:43:56 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:43892: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-23 13:43:34 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:55818: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:46:45 host2 sshd[683831]: Disconnected from invalid user prova 20.123.146.92 port 20956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.94
country_id: 2750405
description:
Dec 23 13:47:57 host2 sshd[684759]: Disconnected from invalid user ann 20.123.146.94 port 45721 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Dec 23 13:49:17 host2 sshd[685873]: Disconnected from invalid user forum 20.123.146.93 port 19715 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:50:23 host2 sshd[686833]: Disconnected from invalid user pula 68.183.46.135 port 58162 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 13:51:01 host2 sshd[687063]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-12-23 13:52:58 dovecot_login authenticator failed for H=(m121-202-195-194.smartone.com) [121.202.195.194]:37163: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 13:53:21 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:58294: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:54:03 host2 sshd[689388]: Disconnected from invalid user cssserver 68.183.46.135 port 43666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec 23 13:53:27 host2 sshd[688930]: Disconnected from invalid user cacheusr 196.188.120.232 port 54732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:53:32 host2 sshd[688985]: Disconnected from invalid user abel 68.183.46.135 port 47788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 23 13:55:15 host2 sshd[690805]: Disconnected from invalid user local 4.210.186.201 port 37528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Dec 23 13:55:24 host2 sshd[690944]: Disconnected from invalid user cvs 196.188.120.232 port 53650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:54:33 host2 sshd[690224]: Disconnected from invalid user marie 68.183.46.135 port 43932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.122
country_id: 226074
description:
Dec 23 13:56:20 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=196.0.122.122, lip=66.85.158.91, TLS, session=<Hy0AS5pGccrEAHp6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:56:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<XBCpTJpGUNADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2025-12-23 13:55:32 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:50079: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-23 13:55:58 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:45247: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:56:37 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<+EZmTZpGbqsDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.189
country_id: 3865483
description:
Dec 23 13:56:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.238.106.189, lip=66.85.158.91, TLS, session=<cDOCTJpG1eYt7mq9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.19.191
country_id: 6252001
description:
[2025-12-23 13:57:30 +0530] info [cpaneld] 73.170.19.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.186.83.157
country_id: 6252001
description:
[2025-12-23 13:57:35 +0530] info [cpaneld] 65.186.83.157 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.178.24
country_id: 6252001
description:
[2025-12-23 13:57:37 +0530] info [cpaneld] 172.56.178.24 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.16.76.113
country_id: 6252001
description:
[2025-12-23 13:57:31 +0530] info [cpaneld] 100.16.76.113 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.55.59.6
country_id: 6252001
description:
[2025-12-23 13:57:32 +0530] info [cpaneld] 136.55.59.6 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.88.62.38
country_id: 6252001
description:
[2025-12-23 13:57:34 +0530] info [whostmgrd] 99.88.62.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.62.47.202
country_id: 6252001
description:
[2025-12-23 13:57:36 +0530] info [cpaneld] 170.62.47.202 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:58:01 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<bW9gUppG7qgDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 211.25.245.56
country_id: 1733045
description:
Dec 23 14:00:53 host2 sshd[695410]: Disconnected from invalid user admin 211.25.245.56 port 45228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.198.249
country_id: 2510769
description:
Dec 23 14:01:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=45.135.198.249, lip=66.85.158.91, TLS, session=<z85PXJpGAbIth8b5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.14.20.239
country_id: 798549
description:
Dec 23 14:00:46 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=31.14.20.239, lip=66.85.158.91, TLS, session=<WfU7W5pGUZMfDhTv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 23 14:02:29 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS: Connection closed, session=<sT5jYppGvpxChJmJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:03:13 host2 sshd[697232]: Disconnected from invalid user vmail 45.12.131.121 port 46296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:03:45 host2 sshd[697554]: Disconnected from invalid user ceshi 45.12.131.121 port 53150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:05:22 host2 sshd[699013]: Disconnected from invalid user deb 45.12.131.121 port 50754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.25.245.56
country_id: 1733045
description:
Dec 23 14:05:40 host2 sshd[699211]: Disconnected from invalid user afa 211.25.245.56 port 46672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-23 14:07:42 dovecot_login authenticator failed for H=(210-167-97-62.cust.smartcall.no) [62.97.167.210]:39086: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-23 14:07:53 dovecot_login authenticator failed for H=(cm-178.232.221.194.get.no) [178.232.221.194]:58483: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-23 14:10:44 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:54371: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-23 14:11:34 dovecot_login authenticator failed for H=([27.123.113.10]) [27.123.113.10]:35074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-23 14:11:39 dovecot_login authenticator failed for H=([182.95.22.249]) [128.185.194.22]:41430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2025-12-23 14:13:23 dovecot_login authenticator failed for H=([49.124.147.96]) [49.124.147.96]:52588: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.62
country_id: 1733045
description:
2025-12-23 14:13:40 dovecot_login authenticator failed for H=([49.124.151.62]) [49.124.151.62]:48276: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.211
country_id: 1733045
description:
2025-12-23 14:13:56 dovecot_login authenticator failed for H=([49.124.149.211]) [49.124.149.211]:50528: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 14:15:11 host2 sshd[709635]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-23 14:15:35 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:34493: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-23 14:15:46 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:45869: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-23 14:15:58 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:41768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-23 14:16:40 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:60532: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.14
country_id: 6252001
description:
Dec 23 14:17:06 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.14, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uwmllppGs7Nb5qgO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.0
country_id: 6252001
description:
Dec 23 14:17:17 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.0, lip=66.85.158.92, TLS: Connection closed, session=<xDJJl5pGyetb5qgA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.11
country_id: 6252001
description:
Dec 23 14:17:25 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.11, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LMPFl5pGFa9b5qgL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.1
country_id: 6252001
description:
Dec 23 14:17:28 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.1, lip=66.85.158.92, TLS: Connection closed, session=<mi/0l5pGKblb5qgB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-23 14:20:25 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:35926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.153.103.91
country_id: 6252001
description:
[2025-12-23 14:20:33 +0530] info [cpaneld] 47.153.103.91 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.165.48.12
country_id: 6252001
description:
[2025-12-23 14:20:38 +0530] info [cpaneld] 67.165.48.12 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-23 14:20:42 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:45210: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.178.188.52
country_id: 6252001
description:
[2025-12-23 14:20:39 +0530] info [cpaneld] 72.178.188.52 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.131.224.44
country_id: 6252001
description:
[2025-12-23 14:20:41 +0530] info [cpaneld] 24.131.224.44 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.63.219.187
country_id: 6252001
description:
[2025-12-23 14:20:27 +0530] info [cpaneld] 192.63.219.187 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.127.222
country_id: 6252001
description:
[2025-12-23 14:20:31 +0530] info [cpaneld] 216.147.127.222 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.229.67.84
country_id: 6252001
description:
[2025-12-23 14:20:35 +0530] info [whostmgrd] 47.229.67.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-23 14:23:26 dovecot_login authenticator failed for H=(201.173.92.217-clientes-izzi.mx) [201.173.92.217]:50157: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-23 14:24:01 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:59619: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-23 14:26:22 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12068: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-23 14:26:45 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:48210: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-23 14:29:00 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:60314: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-23 14:30:04 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:53841: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.39
country_id: 3017382
description:
Dec 23 14:34:41 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.39, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pJqI1ZpGgZVbxJgn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.120
country_id: 3017382
description:
Dec 23 14:34:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.120, lip=66.85.158.92, TLS: Connection closed, session=<3lIo1ppGh7BbxJh4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.36
country_id: 3017382
description:
Dec 23 14:34:58 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.36, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XMiL1ppGT7xbxJgk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.32
country_id: 3017382
description:
Dec 23 14:35:01 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.32, lip=66.85.158.92, TLS: Connection closed, session=<99G71ppGO5RbxJgg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.37.62
country_id: 3144096
description:
2025-12-23 14:36:10 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.37.62]:55587: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2025-12-23 14:36:21 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.13.203]:42095: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:36:42 host2 sshd[732257]: Disconnected from invalid user switch 95.231.213.73 port 58830 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.189.1
country_id: 6252001
description:
[2025-12-23 14:39:05 +0530] info [cpaneld] 135.129.189.1 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 23 14:39:06 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Yq9Q5ZpGQQnCpRCm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.192.155
country_id: 6252001
description:
[2025-12-23 14:39:04 +0530] info [cpaneld] 136.227.192.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.174.170.100
country_id: 6252001
description:
[2025-12-23 14:39:06 +0530] info [cpaneld] 174.174.170.100 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.222.88.228
country_id: 6252001
description:
[2025-12-23 14:39:08 +0530] info [whostmgrd] 98.222.88.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.245.168.194
country_id: 6252001
description:
[2025-12-23 14:39:09 +0530] info [cpaneld] 96.245.168.194 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.96.29.160
country_id: 6252001
description:
[2025-12-23 14:39:10 +0530] info [cpaneld] 74.96.29.160 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.238.131.44
country_id: 6252001
description:
[2025-12-23 14:39:11 +0530] info [cpaneld] 63.238.131.44 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:40:50 host2 sshd[736610]: Disconnected from invalid user newuser 95.231.213.73 port 55206 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 14:41:43 host2 pure-ftpd[737546]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.248.201.228
country_id: 1210997
description:
Dec 23 14:42:26 host2 sshd[738231]: Disconnected from invalid user tp 161.248.201.228 port 50896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Dec 23 14:44:23 host2 sshd[740188]: Disconnected from invalid user temp 161.248.201.228 port 51468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:45:11 host2 sshd[741480]: Disconnected from invalid user vpnuser1 95.231.213.73 port 38620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-23 14:46:00 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:51762: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.217.242.98
country_id: 6252001
description:
[2025-12-23 14:46:58 +0530] info [cpaneld] 73.217.242.98 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.57.191.131
country_id: 6252001
description:
[2025-12-23 14:47:01 +0530] info [cpaneld] 104.57.191.131 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.221.245.59
country_id: 6252001
description:
[2025-12-23 14:47:00 +0530] info [cpaneld] 172.221.245.59 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.138.237.124
country_id: 6252001
description:
[2025-12-23 14:47:02 +0530] info [cpaneld] 35.138.237.124 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.213.47
country_id: 6252001
description:
[2025-12-23 14:46:56 +0530] info [cpaneld] 73.151.213.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.51.195.190
country_id: 6252001
description:
[2025-12-23 14:46:57 +0530] info [cpaneld] 130.51.195.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.215.187.127
country_id: 6252001
description:
[2025-12-23 14:46:59 +0530] info [whostmgrd] 47.215.187.127 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-12-23 14:47:41 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-23 14:50:26 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:41246: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.36
country_id: 2635167
description:
Dec 23 14:50:37 host2 dovecot[3805015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.36, lip=66.85.158.92, TLS, session=<eS6IDptG+5+594kk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-23 14:51:00 dovecot_login authenticator failed for H=([49.124.154.160]) [49.124.154.160]:43420: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2025-12-23 14:53:19 dovecot_login authenticator failed for H=([127.0.0.1]) [24.121.1.156]:38440: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.102.252.82
country_id: 1819730
description:
2025-12-23 14:53:31 dovecot_login authenticator failed for H=pcd720082.netvigator.com ([127.0.0.1]) [218.102.252.82]:60540: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.246.24
country_id: 798544
description:
Dec 23 14:54:47 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=109.125.246.24, lip=66.85.158.91, TLS, session=<9xJqHJtGYaJtffYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.129
country_id: 298795
description:
Dec 23 14:55:07 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.67.155.129, lip=66.85.158.91, TLS, session=<kW6SHZtGJrktQ5uB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:56:57 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<v74oJZtG1MMDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.165.170.41
country_id: 3895114
description:
Dec 23 14:59:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=45.165.170.41, lip=66.85.158.91, TLS, session=<E13pLJtGv94tpaop>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-23 14:59:02 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:61274: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:59:20 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Nza1LZtGdsMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.38
country_id: 6252001
description:
Dec 23 14:59:31 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.38, lip=66.85.158.91, TLS, session=<CJtWLptGoPnN0h8m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-23 14:59:33 dovecot_login authenticator failed for H=(73-161-97-62.cust.smartcall.no) [62.97.161.73]:48443: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:59:38 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<9z28LptG0s4DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.135.223
country_id: 1269750
description:
Dec 23 14:59:47 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=103.59.135.223, lip=66.85.158.91, TLS, session=<c9YaLptGVM9nO4ff>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-23 15:00:58 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:50155: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:00:30 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<X5DWMZtGtKIDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 23 15:00:38 host2 sshd[756550]: Disconnected from invalid user john1 103.123.53.88 port 36590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-23 15:02:06 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:60365: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-23 15:02:25 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:50520: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-23 15:01:31 dovecot_login authenticator failed for H=([203.125.110.142]) [203.125.83.34]:63189: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 23 15:01:53 host2 sshd[757411]: Disconnected from invalid user jenkins 103.123.53.88 port 43796 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:02:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<gXZ0OZtGkqEDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:02:53 host2 dovecot[3805015]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<B01jOptGVqYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-23 15:03:29 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:3160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-23 15:03:49 dovecot_login authenticator failed for H=(client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:35004: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:04:39 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<p7+vQJtGTLIDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2025-12-23 15:12:16 dovecot_login authenticator failed for H=([127.0.0.1]) [158.181.19.144]:50500: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.80
country_id: 953987
description:
Dec 23 15:13:19 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.43.80, lip=66.85.158.91, TLS, session=<+HaVXptGmt9mQCtQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.2
country_id: 1733045
description:
2025-12-23 15:14:55 dovecot_login authenticator failed for H=([49.124.151.2]) [49.124.151.2]:52358: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-23 15:16:51 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:52055: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-12-23 15:17:30 dovecot_login authenticator failed for H=(48-253.adsl.static.espeed.com.bn) [118.103.253.48]:42587: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.171.204.144
country_id: 6252001
description:
[2025-12-23 15:19:00 +0530] info [cpaneld] 70.171.204.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.229.132.218
country_id: 6252001
description:
[2025-12-23 15:19:04 +0530] info [whostmgrd] 138.229.132.218 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.23.71
country_id: 6252001
description:
[2025-12-23 15:19:07 +0530] info [cpaneld] 45.17.23.71 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.136.157
country_id: 6252001
description:
[2025-12-23 15:19:06 +0530] info [cpaneld] 97.170.136.157 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.17.69
country_id: 6252001
description:
[2025-12-23 15:19:05 +0530] info [cpaneld] 76.34.17.69 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.129.193.127
country_id: 6252001
description:
[2025-12-23 15:19:03 +0530] info [cpaneld] 69.129.193.127 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.162.161.243
country_id: 6252001
description:
[2025-12-23 15:19:02 +0530] info [cpaneld] 104.162.161.243 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-23 15:20:06 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:34840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-23 15:20:36 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:40684: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.113
country_id: 2542007
description:
2025-12-23 15:20:36 dovecot_login authenticator failed for H=([105.73.203.113]) [105.73.203.113]:36909: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 15:22:05 host2 sshd[776439]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-23 15:21:18 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:50068: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-23 15:22:44 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:39236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-23 15:22:54 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:37892: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-23 15:23:12 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:59542: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-23 15:23:18 dovecot_login authenticator failed for H=([125.21.7.97]) [128.185.229.126]:42636: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.128.184.28
country_id: 6252001
description:
[2025-12-23 15:28:01 +0530] info [cpaneld] 66.128.184.28 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.40.136
country_id: 6252001
description:
[2025-12-23 15:28:02 +0530] info [cpaneld] 23.241.40.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.148.218.124
country_id: 6252001
description:
[2025-12-23 15:28:03 +0530] info [cpaneld] 35.148.218.124 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.107.140
country_id: 6252001
description:
[2025-12-23 15:28:04 +0530] info [whostmgrd] 173.68.107.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.173.139.151
country_id: 6252001
description:
[2025-12-23 15:28:05 +0530] info [cpaneld] 71.173.139.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.207.59.43
country_id: 6252001
description:
[2025-12-23 15:28:06 +0530] info [cpaneld] 162.207.59.43 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.130.130.239
country_id: 6252001
description:
[2025-12-23 15:28:08 +0530] info [cpaneld] 64.130.130.239 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-12-23 15:29:40 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 15:33:33 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58047: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.253.229.214
country_id: 6252001
description:
Dec 23 15:33:51 host2 pure-ftpd[788977]: (?@192.253.229.214) [INFO] New connection from 192.253.229.214


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 23 15:38:57 host2 sshd[793520]: Disconnected from invalid user admin 152.32.218.149 port 57874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec 23 15:39:30 host2 sshd[793993]: Disconnected from invalid user test3 201.249.205.94 port 33386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-12-23 15:40:13 dovecot_login authenticator failed for H=(nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:54670: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-23 15:40:31 dovecot_login authenticator failed for H=([27.123.119.219]) [182.95.226.118]:50530: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:41:09 host2 sshd[795975]: Disconnected from invalid user admin 103.98.176.164 port 49650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:41:45 host2 sshd[796572]: Disconnected from invalid user west 103.98.176.164 port 56574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:42:20 host2 sshd[797169]: Disconnected from invalid user testadmin 103.98.176.164 port 51250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.205.94
country_id: 3625428
description:
Dec 23 15:43:00 host2 sshd[797740]: Disconnected from invalid user user 201.249.205.94 port 49068 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 15:44:17 host2 pure-ftpd[799193]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-23 15:49:04 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:44194: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-23 15:48:41 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:46067: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-23 15:48:59 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:53704: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-23 15:49:34 dovecot_login authenticator failed for H=(pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:51878: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:49:50 host2 sshd[805844]: Disconnected from invalid user opscode 103.243.27.122 port 55778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 23 15:51:23 host2 sshd[807892]: Disconnected from invalid user vicente 137.184.30.179 port 53966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:51:49 host2 sshd[808314]: Disconnected from invalid user abel 146.190.112.196 port 37930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-23 15:51:52 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [179.185.18.67]:40448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:51:53 host2 sshd[808365]: Disconnected from invalid user testftp 103.243.27.122 port 55140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.168.135.187
country_id: 1643084
description:
Dec 23 15:51:55 host2 sshd[808418]: Disconnected from invalid user jay 103.168.135.187 port 44630 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:52:31 host2 sshd[809224]: Disconnected from invalid user benoit 103.243.27.122 port 39262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:54:41 host2 sshd[812147]: Disconnected from invalid user tsbot 146.190.112.196 port 38534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:55:31 host2 sshd[813303]: Disconnected from invalid user carlos1 172.190.42.55 port 33646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:55:52 host2 sshd[813627]: Disconnected from invalid user gogs 146.190.112.196 port 43202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:56:26 host2 sshd[814143]: Disconnected from invalid user toro 146.190.112.196 port 53042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 23 15:56:39 host2 sshd[814336]: Disconnected from invalid user toto 137.184.30.179 port 37970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:56:46 host2 sshd[814431]: Disconnected from invalid user cynthia 172.190.42.55 port 39176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.59.187
country_id: 290557
description:
Dec 23 15:56:58 host2 sshd[814592]: Disconnected from invalid user ansible 20.203.59.187 port 54382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:57:23 host2 sshd[815007]: Disconnected from invalid user benoit 172.190.42.55 port 54128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.59.187
country_id: 290557
description:
Dec 23 15:57:38 host2 sshd[815229]: Disconnected from invalid user matt 20.203.59.187 port 56634 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 23 16:00:13 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=80.82.77.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EoVuB5xGYOpQUk3K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-23 16:08:43 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:57580: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-23 16:09:00 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:57912: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 16:09:54 host2 sshd[827793]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-23 16:11:53 dovecot_login authenticator failed for H=(92.62.243.175.fibermax.bg) [92.62.243.175]:39393: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.102.101.248
country_id: 1269750
description:
Dec 23 16:12:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=14.102.101.248, lip=66.85.158.91, TLS, session=<0YnNMJxGvcAOZmX4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.140
country_id: 2300660
description:
Dec 23 16:12:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<gihan>, method=PLAIN, rip=41.139.0.140, lip=66.85.158.91, TLS, session=<thVsMpxGxLMpiwCM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-23 16:12:19 dovecot_login authenticator failed for H=([117.248.201.94]) [117.248.201.94]:44330: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.8.125.130
country_id: 3469034
description:
2025-12-23 16:12:32 dovecot_login authenticator failed for H=([189.8.125.130]) [189.8.125.130]:57253: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.27
country_id: 298795
description:
2025-12-23 16:15:12 dovecot_login authenticator failed for H=([188.59.178.27]) [188.59.178.27]:38167: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-23 16:15:37 dovecot_login authenticator failed for H=(nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:36339: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.51
country_id: 3175395
description:
Dec 23 16:16:39 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.15.171.51, lip=66.85.158.91, TLS, session=<G9EsQZxGMOK5D6sz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.240
country_id: 3469034
description:
Dec 23 16:16:59 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=190.89.137.240, lip=66.85.158.91, TLS, session=<9LNVQpxGX9u+WYnw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-23 16:17:33 dovecot_login authenticator failed for H=([128.185.222.216]) [128.185.242.74]:48250: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-23 16:18:10 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:45023: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.196.4
country_id: 6252001
description:
Dec 23 16:18:32 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.196.4, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zQjqSJxGGOkUasQE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2025-12-23 16:19:34 dovecot_login authenticator failed for H=([127.0.0.1]) [177.236.145.94]:54257: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2025-12-23 16:19:48 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.231.114]:53554: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.52.51
country_id: 2921044
description:
[2025-12-23 16:22:37 +0530] info [webmaild] 178.16.52.51 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-23 16:23:24 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:40389: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-12-23 16:24:40 dovecot_login authenticator failed for H=([38.141.252.55]) [38.141.252.55]:40858: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-23 16:24:57 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:51222: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.8.5.53
country_id: 6252001
description:
[2025-12-23 16:29:22 +0530] info [cpaneld] 99.8.5.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.224.47
country_id: 6252001
description:
[2025-12-23 16:29:25 +0530] info [cpaneld] 99.66.224.47 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.57.16.238
country_id: 6252001
description:
[2025-12-23 16:29:24 +0530] info [whostmgrd] 104.57.16.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.56.217
country_id: 6252001
description:
[2025-12-23 16:29:27 +0530] info [cpaneld] 74.132.56.217 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.82.34.218
country_id: 6252001
description:
[2025-12-23 16:29:26 +0530] info [cpaneld] 73.82.34.218 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.105.33.168
country_id: 6252001
description:
[2025-12-23 16:29:18 +0530] info [cpaneld] 70.105.33.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.23.61.229
country_id: 6252001
description:
[2025-12-23 16:29:23 +0530] info [cpaneld] 184.23.61.229 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-12-23 16:40:25 dovecot_login authenticator failed for H=111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:50319: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-23 16:40:43 dovecot_login authenticator failed for H=([46.212.111.48]) [46.212.111.48]:37526: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-23 16:41:40 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:44128: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-23 16:42:03 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:56750: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.112.85
country_id: 3469034
description:
Dec 23 16:44:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=177.87.112.85, lip=66.85.158.91, TLS, session=<xtZNpJxGGbmxV3BV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.127
country_id: 3175395
description:
Dec 23 16:44:42 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.139.180.127, lip=66.85.158.91, TLS, session=<anSCpZxG2si5i7R/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 16:46:40 host2 pure-ftpd[865130]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-23 16:54:20 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:55280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-23 16:54:57 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:45916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-23 16:57:12 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:38009: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-23 16:57:34 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:51104: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.178.165
country_id: 6252001
description:
Dec 23 16:58:39 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.249.178.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5bpo2JxGGrxK+bKl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.58.186.189
country_id: 6252001
description:
[2025-12-23 16:59:06 +0530] info [webmaild] 199.58.186.189 - info@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-12-23 17:02:17 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:55694: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-23 17:02:50 dovecot_login authenticator failed for H=([182.79.70.81]) [27.123.97.74]:53710: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Dec 23 17:16:00 host2 pure-ftpd[897311]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 17:17:15 host2 sshd[898757]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-23 17:20:10 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:39668: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-23 17:20:24 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:41764: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-23 17:21:06 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:54896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 17:21:34 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:54509: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2025-12-23 17:23:43 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:55963: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Dec 23 17:24:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QjyTM51Glg7BJf1d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-12-23 17:24:11 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:50719: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-23 17:24:44 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:48250: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.115.201.137
country_id: 6252001
description:
[2025-12-23 17:27:10 +0530] info [cpaneld] 23.115.201.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.91.244.69
country_id: 6252001
description:
[2025-12-23 17:27:14 +0530] info [whostmgrd] 173.91.244.69 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.161.229
country_id: 6252001
description:
[2025-12-23 17:27:13 +0530] info [cpaneld] 76.176.161.229 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.94.85.50
country_id: 6252001
description:
[2025-12-23 17:27:16 +0530] info [cpaneld] 97.94.85.50 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.37.227.28
country_id: 6252001
description:
[2025-12-23 17:27:17 +0530] info [cpaneld] 47.37.227.28 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-23 17:26:47 dovecot_login authenticator failed for H=31-151-70-150.dynamic.upc.nl [31.151.70.150]:44427: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.231.27.63
country_id: 6252001
description:
[2025-12-23 17:27:11 +0530] info [cpaneld] 104.231.27.63 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.11.48.208
country_id: 6252001
description:
[2025-12-23 17:27:20 +0530] info [cpaneld] 24.11.48.208 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-23 17:27:23 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:55590: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-23 17:27:54 dovecot_login authenticator failed for H=([189.109.154.54]) [189.109.154.54]:42393: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-12-23 17:28:02 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:33056: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.223.8
country_id: 798544
description:
Dec 23 17:33:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=213.92.223.8, lip=66.85.158.91, TLS, session=<9cE4U51GlobVXN8I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 17:34:07 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<L/QSV51GeKXBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-23 17:33:25 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:57575: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.108.55
country_id: 3469034
description:
Dec 23 17:33:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.224.108.55, lip=66.85.158.91, TLS, session=<YRdgVJ1GZ6m64Gw3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-23 17:33:56 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:40446: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 23 17:35:41 host2 sshd[915281]: Disconnected from invalid user bot1 51.38.98.14 port 59336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:35:57 host2 sshd[915458]: Disconnected from invalid user nexus 50.37.231.46 port 40708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:36:04 host2 sshd[915556]: Disconnected from invalid user mapr 190.129.122.185 port 48070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.39
country_id: 3469034
description:
Dec 23 17:36:08 host2 sshd[915609]: Disconnected from invalid user sunil 189.8.108.39 port 58908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 23 17:36:15 host2 sshd[915664]: Disconnected from invalid user sftptest 51.38.98.14 port 46444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:36:48 host2 sshd[915970]: Disconnected from invalid user python 190.129.122.185 port 38920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.39
country_id: 3469034
description:
Dec 23 17:36:52 host2 sshd[916033]: Disconnected from invalid user jitendra 189.8.108.39 port 34920 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.78
country_id: 2635167
description:
Dec 23 17:37:19 host2 dovecot[3805015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.78, lip=66.85.158.91, TLS, session=<+82pYp1Gtcu594lO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:36:31 host2 sshd[915843]: Disconnected from invalid user sunil 50.37.231.46 port 51632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:37:31 host2 sshd[916508]: Disconnected from invalid user rabbitmq 190.129.122.185 port 56474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:37:42 host2 sshd[916671]: Disconnected from invalid user mapr 50.37.231.46 port 40366 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.94.135.131
country_id: 6252001
description:
[2025-12-23 17:39:07 +0530] info [whostmgrd] 66.94.135.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.251.161.33
country_id: 6252001
description:
[2025-12-23 17:39:08 +0530] info [cpaneld] 69.251.161.33 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.9.110
country_id: 6252001
description:
[2025-12-23 17:39:09 +0530] info [cpaneld] 73.170.9.110 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.56.160.112
country_id: 6252001
description:
[2025-12-23 17:39:11 +0530] info [cpaneld] 134.56.160.112 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.249.52.45
country_id: 6252001
description:
[2025-12-23 17:39:02 +0530] info [cpaneld] 71.249.52.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.60.7
country_id: 6252001
description:
[2025-12-23 17:39:04 +0530] info [cpaneld] 172.56.60.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.113.183.72
country_id: 6252001
description:
[2025-12-23 17:39:05 +0530] info [cpaneld] 99.113.183.72 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-12-23 17:41:45 dovecot_login authenticator failed for H=(ws99-36-153-203.rcil.gov.in) [182.72.143.2]:41886: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-23 17:42:20 dovecot_login authenticator failed for H=(189.219.138.45-clientes-izzi.mx) [189.219.138.45]:44353: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 17:49:10 host2 pure-ftpd[927490]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-23 17:51:43 dovecot_login authenticator failed for H=([110.49.147.210]) [110.49.147.210]:42914: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-23 17:51:57 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:55104: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-23 17:54:17 dovecot_login authenticator failed for H=([103.140.18.186]) [103.140.18.186]:53242: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.27
country_id: 1522867
description:
2025-12-23 17:54:30 dovecot_login authenticator failed for H=([212.116.247.27]) [212.116.247.27]:47482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 17:55:16 host2 sshd[932661]: Disconnected from invalid user hadoop 139.59.26.79 port 54264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-23 17:57:12 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:53890: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.65
country_id: 2542007
description:
2025-12-23 17:56:49 dovecot_login authenticator failed for H=([105.73.190.65]) [105.73.190.65]:34254: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 17:58:28 host2 sshd[935371]: Disconnected from invalid user admin 101.36.117.148 port 42896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-23 17:59:14 dovecot_login authenticator failed for H=(201.172.88.155-clientes-izzi.mx) [201.172.88.155]:40600: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 23 18:00:08 host2 sshd[936253]: Disconnected from invalid user admin2 27.111.32.174 port 50586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:00:16 host2 sshd[936353]: Disconnected from invalid user admin 139.59.26.79 port 37142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-23 17:59:44 dovecot_login authenticator failed for H=([196.190.43.138]) [196.190.41.137]:31125: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 18:00:27 host2 sshd[936560]: Disconnected from invalid user dcadmin 101.36.117.148 port 58700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:00:35 host2 sshd[936624]: Disconnected from invalid user design 45.78.223.101 port 57598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-23 18:00:54 dovecot_login authenticator failed for H=([213.32.253.235]) [213.32.253.235]:55257: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:00:56 host2 sshd[936899]: Disconnected from invalid user git 139.59.26.79 port 35710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 23 18:02:02 host2 sshd[937730]: Disconnected from invalid user mcbserver 27.111.32.174 port 60884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:01:33 host2 sshd[937326]: Disconnected from invalid user robot 139.59.26.79 port 58262 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 18:01:37 host2 sshd[937369]: Disconnected from invalid user admin 101.36.117.148 port 60164 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.201.71.44
country_id: 6252001
description:
[2025-12-23 18:03:55 +0530] info [cpaneld] 71.201.71.44 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.144.82
country_id: 6252001
description:
[2025-12-23 18:03:58 +0530] info [cpaneld] 76.32.144.82 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.14.152.72
country_id: 6252001
description:
[2025-12-23 18:03:57 +0530] info [cpaneld] 76.14.152.72 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.130.2.46
country_id: 6252001
description:
[2025-12-23 18:03:48 +0530] info [cpaneld] 74.130.2.46 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.111.104.2
country_id: 6252001
description:
[2025-12-23 18:03:50 +0530] info [cpaneld] 73.111.104.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.2.55.83
country_id: 6252001
description:
[2025-12-23 18:03:51 +0530] info [cpaneld] 160.2.55.83 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.143.28.201
country_id: 6252001
description:
[2025-12-23 18:03:54 +0530] info [whostmgrd] 69.143.28.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:05:14 host2 sshd[940601]: Disconnected from invalid user test 45.78.223.101 port 51588 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 18:05:30 host2 sshd[940958]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-23 18:06:29 dovecot_login authenticator failed for H=([207.219.221.53]) [207.219.221.53]:52091: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-23 18:06:47 dovecot_login authenticator failed for H=(cm-178.232.126.146.get.no) [178.232.126.146]:56721: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-23 18:07:35 dovecot_login authenticator failed for H=(beta.corporatecitizen.in) [103.29.235.44]:36344: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-12-23 18:07:58 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:60084: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 18:08:29 host2 sshd[942874]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:08:33 host2 sshd[942904]: Disconnected from invalid user gitlab 45.78.223.101 port 44144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec 23 18:09:20 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<13wn1Z1Gav4t4/6b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-23 18:09:28 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([127.0.0.1]) [62.103.27.217]:54088: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2025-12-23 18:09:55 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.228.106]:40882: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.181.57
country_id: 6252001
description:
Dec 23 18:17:24 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.181.57, lip=66.85.158.91, TLS, session=<JrMM8p1GuN2l47U5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-23 18:19:05 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:36630: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2025-12-23 18:19:23 dovecot_login authenticator failed for H=(nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:46094: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-23 18:21:54 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:57648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2025-12-23 18:22:41 dovecot_login authenticator failed for H=([49.124.151.57]) [49.124.151.57]:51538: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.97.118
country_id: 3469034
description:
Dec 23 18:31:10 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=167.249.97.118, lip=66.85.158.91, TLS, session=<hi8kIp5GGbSn+WF2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.99
country_id: 953987
description:
Dec 23 18:31:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.54.99, lip=66.85.158.91, TLS, session=<kNdnI55G9qNmgTZj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.27.7
country_id: 933860
description:
Dec 23 18:35:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=83.143.27.7, lip=66.85.158.91, TLS, session=<NwEPM55GY9VTjxsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.211
country_id: 6290252
description:
Dec 23 18:36:14 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=109.207.35.211, lip=66.85.158.91, TLS, session=<W01qNJ5GBKhtzyPT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.15.87.157
country_id: 6252001
description:
[2025-12-23 18:39:23 +0530] info [cpaneld] 24.15.87.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.249.126.252
country_id: 6252001
description:
[2025-12-23 18:39:31 +0530] info [cpaneld] 98.249.126.252 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.252.6.93
country_id: 6252001
description:
[2025-12-23 18:39:32 +0530] info [cpaneld] 67.252.6.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.134.28.74
country_id: 6252001
description:
[2025-12-23 18:39:25 +0530] info [cpaneld] 72.134.28.74 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.7.84
country_id: 6252001
description:
[2025-12-23 18:39:27 +0530] info [cpaneld] 76.90.7.84 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.74.63.10
country_id: 6252001
description:
[2025-12-23 18:39:28 +0530] info [whostmgrd] 174.74.63.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.9.20.106
country_id: 6252001
description:
[2025-12-23 18:39:30 +0530] info [cpaneld] 24.9.20.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.113.225.118
country_id: 6252001
description:
[2025-12-23 18:43:36 +0530] info [cpaneld] 68.113.225.118 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.250.135.104
country_id: 6252001
description:
[2025-12-23 18:43:37 +0530] info [cpaneld] 108.250.135.104 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.121.104.14
country_id: 6252001
description:
[2025-12-23 18:43:38 +0530] info [cpaneld] 24.121.104.14 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.71.203.169
country_id: 6252001
description:
[2025-12-23 18:43:30 +0530] info [cpaneld] 75.71.203.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.188.242.176
country_id: 6252001
description:
[2025-12-23 18:43:31 +0530] info [cpaneld] 47.188.242.176 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.184.189.48
country_id: 6252001
description:
[2025-12-23 18:43:33 +0530] info [cpaneld] 184.184.189.48 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.237.155
country_id: 6252001
description:
[2025-12-23 18:43:34 +0530] info [whostmgrd] 76.168.237.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.21
country_id: 798549
description:
Dec 23 18:48:15 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.21, lip=66.85.158.92, session=<7f1eYJ5GOr9V2ZUV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 18:51:48 host2 pure-ftpd[979063]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:51:58 host2 sshd[979251]: Disconnected from invalid user postgres 162.241.87.197 port 37574 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.241.155.116
country_id: 6252001
description:
Dec 23 18:54:57 host2 pure-ftpd[983194]: (?@192.241.155.116) [INFO] New connection from 192.241.155.116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.241.155.116
country_id: 6252001
description:
Dec 23 18:54:56 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.241.155.116, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gqc/eJ5G1OnA8Zt0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-23 18:55:58 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-23 18:56:17 dovecot_login authenticator failed for H=(cm-178.232.201.31.get.no) [178.232.201.31]:38144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:56:18 host2 sshd[984922]: Disconnected from invalid user dev 162.241.87.197 port 36434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:56:55 host2 sshd[985497]: Disconnected from invalid user minecraft 162.241.87.197 port 43700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:57:32 host2 sshd[986132]: Disconnected from invalid user jenkins 162.241.87.197 port 39506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.228.161.66
country_id: 1327865
description:
Dec 23 18:57:38 host2 sshd[986147]: Disconnected from invalid user ethan 136.228.161.66 port 58482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Dec 23 18:59:42 host2 sshd[987879]: Disconnected from invalid user factorio 94.102.4.12 port 43664 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.102.4.12
country_id: 298795
description:
Dec 23 19:00:24 host2 sshd[988650]: Disconnected from invalid user user11 94.102.4.12 port 57396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2025-12-23 19:00:48 dovecot_login authenticator failed for H=([87.200.93.86]) [87.200.93.86]:46309: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 23 19:00:56 host2 sshd[989009]: Disconnected from invalid user usertest 160.251.197.41 port 57530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 19:01:48 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57469: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.197.73.147
country_id: 2661886
description:
Dec 23 19:02:19 host2 sshd[989915]: Disconnected from invalid user vncuser 82.197.73.147 port 45486 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.197.73.147
country_id: 2661886
description:
Dec 23 19:03:28 host2 sshd[990852]: Disconnected from invalid user user11 82.197.73.147 port 39006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 23 19:05:04 host2 sshd[992513]: Disconnected from invalid user vnc 160.251.197.41 port 37078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.76.135.162
country_id: 6252001
description:
2025-12-23 19:06:01 dovecot_login authenticator failed for H=149-76-135-162.fidnet.com [149.76.135.162]:53114: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-23 19:06:22 dovecot_login authenticator failed for H=([65.20.187.47]) [65.20.187.47]:58895: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.87
country_id: 1643084
description:
Dec 23 19:07:24 host2 sshd[995171]: Disconnected from invalid user qwe 103.23.199.87 port 39294 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-23 19:07:32 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:33300: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-23 19:07:46 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:33345: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.174.85
country_id: 1643084
description:
2025-12-23 19:11:04 dovecot_login authenticator failed for H=([36.92.174.85]) [36.92.174.85]:55021: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-23 19:11:16 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:34379: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 19:13:17 host2 sshd[1001389]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-23 19:12:27 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:41416: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.170.45
country_id: 6252001
description:
Dec 23 19:12:57 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.170.45, lip=66.85.158.91, session=<Z8GquJ5GppgofKot>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.220.144
country_id: 2921044
description:
Dec 23 19:14:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=68.183.220.144, lip=66.85.158.92, session=<MJxovp5G/RNEt9yQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.115.140
country_id: 2921044
description:
Dec 23 19:14:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.115.140, lip=66.85.158.92, session=<yypuvp5GCG4uZXOM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-23 19:15:01 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:43676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-23 19:15:26 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:49386: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-23 19:18:35 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:51534: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.197.28
country_id: 2542007
description:
2025-12-23 19:19:29 dovecot_login authenticator failed for H=([105.73.197.28]) [105.73.197.28]:37399: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.12.22.249
country_id: 6252001
description:
Dec 23 19:25:20 host2 pure-ftpd[1010510]: (?@154.12.22.249) [INFO] New connection from 154.12.22.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.0.164.73
country_id: 3508796
description:
2025-12-23 19:30:15 dovecot_login authenticator failed for H=([127.0.0.1]) [148.0.164.73]:41665: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 23 19:31:06 host2 pure-ftpd[1015480]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.67.53
country_id: 6252001
description:
2025-12-23 19:30:31 dovecot_login authenticator failed for H=([127.0.0.1]) [136.228.67.53]:54154: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.25
country_id: 2510769
description:
Dec 23 19:31:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=139.28.190.25, lip=66.85.158.91, TLS, session=<1ZKt+Z5Gj6yLHL4Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.16
country_id: 6252001
description:
Dec 23 19:31:31 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.16, lip=66.85.158.92, session=<pR8T+55GjtkUQcIQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 23 19:31:40 host2 pure-ftpd[1015784]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.150
country_id: 3865483
description:
Dec 23 19:31:47 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.252.150, lip=66.85.158.91, TLS, session=<cvfd+p5GtumzAPyW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.209
country_id: 953987
description:
Dec 23 19:36:16 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=102.129.63.209, lip=66.85.158.91, TLS, session=<wizaCp9G88ZmgT/R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.27.7
country_id: 933860
description:
Dec 23 19:36:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=83.143.27.7, lip=66.85.158.91, TLS, session=<Mp0yDJ9GlOxTjxsH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.185.120.213
country_id: 130758
description:
Dec 23 19:37:17 host2 sshd[1020135]: Disconnected from invalid user m 85.185.120.213 port 51250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 23 19:37:53 host2 sshd[1020731]: Disconnected from invalid user iview 85.185.120.213 port 47234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-23 19:43:42 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:42516: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-12-23 19:43:57 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:38334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-23 19:45:38 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:39200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-23 19:45:56 dovecot_login authenticator failed for H=(nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:34830: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.225.30.41
country_id: 241170
description:
Dec 23 19:51:26 host2 pure-ftpd[1031727]: (?@156.225.30.41) [INFO] New connection from 156.225.30.41


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.244.187
country_id: 1880251
description:
Dec 23 19:51:52 host2 sshd[1032018]: Disconnected from invalid user git 43.160.244.187 port 51652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Dec 23 19:51:57 host2 sshd[1032081]: Disconnected from invalid user pzserver 45.164.39.253 port 38848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-12-23 19:52:30 dovecot_login authenticator failed for H=([182.95.222.186]) [182.95.222.186]:39624: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.146.253
country_id: 2750405
description:
Dec 23 19:52:47 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=161.35.146.253, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<MUElR59GFoChI5L9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-23 19:53:03 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:52580: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.244.187
country_id: 1880251
description:
Dec 23 19:53:53 host2 sshd[1033518]: Disconnected from invalid user root1 43.160.244.187 port 59230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.160.244.187
country_id: 1880251
description:
Dec 23 19:54:34 host2 sshd[1034352]: Disconnected from invalid user sysadmin 43.160.244.187 port 45464 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 19:54:36 host2 pure-ftpd[1034384]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 23 19:55:05 host2 sshd[1034773]: Disconnected from invalid user t128 141.145.147.99 port 35434 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.104.141
country_id: 6252001
description:
Dec 23 19:55:23 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.104.141, lip=66.85.158.91, session=<9aVuUJ9GoMihI2iN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 23 19:56:59 host2 sshd[1036431]: Disconnected from invalid user webadmin 102.88.137.80 port 1063 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 23 19:57:27 host2 sshd[1036848]: Disconnected from invalid user shyam 62.97.44.51 port 55444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.14.28
country_id: 1668284
description:
Dec 23 19:57:32 host2 sshd[1036936]: Disconnected from invalid user nishant 165.154.14.28 port 48058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 23 19:58:28 host2 sshd[1037993]: Disconnected from invalid user bayu 102.88.137.80 port 1029 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Dec 23 20:01:15 host2 sshd[1041661]: Disconnected from invalid user nishant 45.164.39.253 port 53444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 23 20:00:26 host2 sshd[1041010]: Disconnected from invalid user git 141.145.147.99 port 34846 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 23 20:02:20 host2 sshd[1042613]: Received disconnect from 62.97.44.51 port 36034:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.14.28
country_id: 1668284
description:
Dec 23 20:01:30 host2 sshd[1041871]: Disconnected from invalid user noroot 165.154.14.28 port 43660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-12-23 20:04:38 dovecot_login authenticator failed for H=(static.bb.btd.59.99.153.21.bsnl.in) [59.99.153.21]:45860: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-23 20:04:47 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:40892: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.192.162
country_id: 732800
description:
[2025-12-23 20:05:20 +0530] info [webmaild] 185.94.192.162 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.104.141
country_id: 6252001
description:
Dec 23 20:08:55 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=161.35.104.141, lip=66.85.158.92, session=<3nzVgJ9GJtChI2iN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.145.147.99
country_id: 290557
description:
Dec 23 20:11:13 host2 sshd[1050625]: Disconnected from invalid user test1 141.145.147.99 port 38640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2025-12-23 20:20:44 dovecot_login authenticator failed for H=([125.19.164.187]) [125.19.162.102]:57798: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.132
country_id: 6252001
description:
Dec 23 20:26:28 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.132, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wi2dv59Gf6xb5qiE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.238
country_id: 6252001
description:
Dec 23 20:26:31 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.238, lip=66.85.158.92, TLS: Connection closed, session=<E4LLv59Gy9lb5qju>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.0.66.89
country_id: 6252001
description:
[2025-12-23 20:26:36 +0530] info [cpaneld] 68.0.66.89 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.134
country_id: 6252001
description:
Dec 23 20:26:11 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.134, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GH+Zvp9GZ8Rb5qiG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.131
country_id: 6252001
description:
Dec 23 20:26:23 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.230.168.131, lip=66.85.158.92, TLS: Connection closed, session=<251Jv59GDepb5qiD>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 20:26:45 host2 sshd[1064022]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.153.141.87
country_id: 6252001
description:
[2025-12-23 20:26:41 +0530] info [cpaneld] 99.153.141.87 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.151.166.199
country_id: 6252001
description:
[2025-12-23 20:26:43 +0530] info [cpaneld] 24.151.166.199 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.55.203.128
country_id: 6252001
description:
[2025-12-23 20:26:46 +0530] info [cpaneld] 99.55.203.128 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.203.120.31
country_id: 6252001
description:
[2025-12-23 20:26:39 +0530] info [cpaneld] 170.203.120.31 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.207.28.245
country_id: 6252001
description:
[2025-12-23 20:26:38 +0530] info [cpaneld] 107.207.28.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.183.0.171
country_id: 6252001
description:
[2025-12-23 20:26:40 +0530] info [whostmgrd] 24.183.0.171 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Dec 23 20:29:00 host2 sshd[1065294]: Disconnected from invalid user git 68.183.93.67 port 52684 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.227
country_id: 6252001
description:
Dec 23 20:29:09 host2 pure-ftpd[1065476]: (?@64.62.197.227) [INFO] New connection from 64.62.197.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.72.59
country_id: 3996063
description:
2025-12-23 20:29:11 dovecot_login authenticator failed for H=(201.173.72.59-clientes-izzi.mx) [201.173.72.59]:41320: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-12-23 20:29:25 dovecot_login authenticator failed for H=([182.95.131.41]) [103.251.31.166]:35118: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.53
country_id: 6252001
description:
Dec 23 20:29:29 host2 pure-ftpd[1065674]: (?@167.94.146.53) [INFO] New connection from 167.94.146.53


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.37
country_id: 3923057
description:
Dec 23 20:30:37 host2 sshd[1067036]: Disconnected from invalid user localuser 190.181.27.37 port 53960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.15
country_id: 933860
description:
Dec 23 20:32:36 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<info>, method=PLAIN, rip=41.216.213.15, lip=66.85.158.91, TLS, session=<y97c059Gd9Up2NUP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.158
country_id: 3865483
description:
Dec 23 20:32:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=45.238.106.158, lip=66.85.158.91, TLS, session=<s7ZY0p9GuJkt7mqe>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.37
country_id: 3923057
description:
Dec 23 20:32:07 host2 sshd[1068081]: Disconnected from invalid user ubuntu 190.181.27.37 port 51850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Dec 23 20:33:09 host2 sshd[1068807]: Disconnected from invalid user cloud 68.183.93.67 port 58278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.93.67
country_id: 1269750
description:
Dec 23 20:33:50 host2 sshd[1069231]: Disconnected from invalid user guest 68.183.93.67 port 39114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-23 20:35:36 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:39632: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-23 20:35:50 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:44366: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.77
country_id: 732800
description:
Dec 23 20:37:15 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.253.159.77, lip=66.85.158.91, TLS, session=<0tIj5Z9G6rm5/Z9N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.137
country_id: 3277605
description:
Dec 23 20:36:46 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=188.246.73.137, lip=66.85.158.91, TLS, session=</Gtv459G7Ai89kmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-12-23 20:38:13 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37556: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.178
country_id: 3017382
description:
Dec 23 20:39:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.178, lip=66.85.158.92, TLS handshaking: Connection closed, session=<To8i7Z9Gl8tbxJiy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.213
country_id: 3017382
description:
Dec 23 20:39:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.213, lip=66.85.158.92, TLS: Connection closed, session=<qDDW7Z9GY4hbxJjV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.179
country_id: 3017382
description:
Dec 23 20:39:30 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.179, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7dc37p9GXYhbxJiz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.208
country_id: 3017382
description:
Dec 23 20:39:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.208, lip=66.85.158.92, TLS: Connection closed, session=<OcJn7p9GQ4ZbxJjQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-23 20:38:44 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:52725: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-23 20:39:03 dovecot_login authenticator failed for H=069.138.48.116.static.netvigator.com [116.48.138.69]:53446: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-23 20:41:45 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:41100: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.95.157.171
country_id: 1861060
description:
Dec 23 20:43:01 host2 sshd[1077006]: Disconnected from invalid user db2fenc1 150.95.157.171 port 42120 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.9.4.81
country_id: 6252001
description:
[2025-12-23 20:44:47 +0530] info [cpaneld] 70.9.4.81 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.95.90.160
country_id: 6252001
description:
[2025-12-23 20:44:49 +0530] info [whostmgrd] 73.95.90.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.9.118
country_id: 6252001
description:
[2025-12-23 20:44:52 +0530] info [cpaneld] 47.157.9.118 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.53.72.109
country_id: 6252001
description:
[2025-12-23 20:44:53 +0530] info [cpaneld] 50.53.72.109 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.213.63
country_id: 6252001
description:
[2025-12-23 20:44:54 +0530] info [cpaneld] 96.241.213.63 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.34.3.58
country_id: 6252001
description:
[2025-12-23 20:44:44 +0530] info [cpaneld] 68.34.3.58 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.231.40.245
country_id: 6252001
description:
[2025-12-23 20:44:47 +0530] info [cpaneld] 73.231.40.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.23.172.153
country_id: 6252001
description:
Dec 23 20:47:18 host2 sshd[1081219]: Disconnected from invalid user wg 154.23.172.153 port 61782 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.94.14
country_id: 6252001
description:
[2025-12-23 20:49:29 +0530] info [cpaneld] 96.2.94.14 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.252.58.100
country_id: 6252001
description:
[2025-12-23 20:49:31 +0530] info [whostmgrd] 108.252.58.100 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.41.120
country_id: 6252001
description:
[2025-12-23 20:49:33 +0530] info [cpaneld] 76.90.41.120 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.117.101.214
country_id: 6252001
description:
[2025-12-23 20:49:32 +0530] info [cpaneld] 97.117.101.214 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.85.173.185
country_id: 6252001
description:
[2025-12-23 20:49:34 +0530] info [cpaneld] 73.85.173.185 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.171.228.74
country_id: 6252001
description:
[2025-12-23 20:49:24 +0530] info [cpaneld] 97.171.228.74 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.28.121.7
country_id: 6252001
description:
[2025-12-23 20:49:28 +0530] info [cpaneld] 38.28.121.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-23 20:50:47 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:34650: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-23 20:51:07 dovecot_login authenticator failed for H=(200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:55795: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2025-12-23 20:51:57 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:56959: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec 23 20:52:04 host2 sshd[1085607]: Disconnected from invalid user user1 52.250.16.220 port 36254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-23 20:52:47 dovecot_login authenticator failed for H=static-213-130-207-177.cust.tele2.lt [213.130.207.177]:50552: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.250.16.220
country_id: 6252001
description:
Dec 23 20:53:12 host2 sshd[1086668]: Disconnected from invalid user pankaj 52.250.16.220 port 53938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec 23 20:53:49 host2 sshd[1087224]: Disconnected from invalid user nadmin 52.250.16.220 port 57190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec 23 20:55:06 host2 sshd[1089041]: Disconnected from invalid user exam 52.250.16.220 port 44672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 23 20:56:20 host2 sshd[1090478]: Disconnected from invalid user gitlab-runner 103.250.10.42 port 34728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-23 20:56:31 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:42782: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-23 20:57:01 dovecot_login authenticator failed for H=([207.219.221.101]) [207.219.221.101]:37090: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 20:57:30 host2 pure-ftpd[1091863]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.77
country_id: 2510769
description:
Dec 23 20:57:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=139.28.190.77, lip=66.85.158.91, TLS, session=<Pz6PLaBGzo2LHL5N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.14
country_id: 798544
description:
Dec 23 20:57:50 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.231.121.14, lip=66.85.158.91, TLS, session=<n7bILqBG7IJb53kO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 23 20:57:55 host2 sshd[1092281]: Disconnected from invalid user teamtalk 103.250.10.42 port 39472 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.109.120.208
country_id: 6252001
description:
[2025-12-23 21:01:09 +0530] info [cpaneld] 143.109.120.208 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.211.180.157
country_id: 6252001
description:
[2025-12-23 21:01:13 +0530] info [cpaneld] 76.211.180.157 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.134.38
country_id: 6252001
description:
[2025-12-23 21:01:06 +0530] info [cpaneld] 45.31.134.38 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.60.181.138
country_id: 6252001
description:
[2025-12-23 21:01:07 +0530] info [cpaneld] 104.60.181.138 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.131.125.235
country_id: 6252001
description:
[2025-12-23 21:01:11 +0530] info [cpaneld] 97.131.125.235 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 23 21:00:54 host2 sshd[1095499]: Disconnected from invalid user postgres 36.255.223.75 port 63214 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.62.45.163
country_id: 6252001
description:
[2025-12-23 21:01:04 +0530] info [cpaneld] 68.62.45.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.42.134.29
country_id: 6252001
description:
[2025-12-23 21:01:08 +0530] info [whostmgrd] 68.42.134.29 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.5.135
country_id: 6252001
description:
Dec 23 21:02:09 host2 sshd[1096655]: Disconnected from invalid user nexus 165.227.5.135 port 43920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 23 21:02:31 host2 sshd[1097126]: Disconnected from invalid user ubuntu 200.69.236.207 port 56637 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.159.132.213
country_id: 2921044
description:
Dec 23 21:01:52 host2 sshd[1096366]: Disconnected from invalid user deep 34.159.132.213 port 37810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.159.132.213
country_id: 2921044
description:
Dec 23 21:03:40 host2 sshd[1098220]: Disconnected from invalid user ftpuser 34.159.132.213 port 49398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 23 21:04:31 host2 sshd[1098980]: Disconnected from invalid user ubuntu 200.69.236.207 port 44758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.159.132.213
country_id: 2921044
description:
Dec 23 21:04:52 host2 sshd[1099305]: Disconnected from invalid user testuser 34.159.132.213 port 35386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 23 21:05:19 host2 sshd[1099796]: Disconnected from invalid user git 200.69.236.207 port 51661 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 23 21:06:20 host2 sshd[1100601]: Disconnected from invalid user ttbot 36.255.223.75 port 43090 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.154
country_id: 1880251
description:
Dec 23 21:07:05 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=94.231.206.154, lip=66.85.158.92, session=<oLHeUKBGc7Ne586a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.152
country_id: 1880251
description:
Dec 23 21:07:27 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.152, lip=66.85.158.92, session=<cHIuUqBG96Ze586Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.5.135
country_id: 6252001
description:
Dec 23 21:06:52 host2 sshd[1101013]: Disconnected from invalid user git 165.227.5.135 port 52108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.204
country_id: 1880251
description:
Dec 23 21:07:16 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.204, lip=66.85.158.92, session=<sAOEUaBGCcFe587M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.159.132.213
country_id: 2921044
description:
Dec 23 21:06:39 host2 sshd[1100805]: Disconnected from invalid user jarservice 34.159.132.213 port 50554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.136
country_id: 6252001
description:
Dec 23 21:06:41 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.136, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LmVqT6BGx8Wi2JaI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.31.53
country_id: 6252001
description:
2025-12-23 21:06:49 dovecot_login authenticator failed for H=(maximsholdings.com) [45.83.31.53]:50450: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.105
country_id: 1814991
description:
Dec 23 21:08:08 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=94.231.206.105, lip=66.85.158.92, session=<5FqVVKBGF8pe585p>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.5.135
country_id: 6252001
description:
Dec 23 21:08:07 host2 sshd[1102178]: Disconnected from invalid user jimmy 165.227.5.135 port 59950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.33
country_id: 1814991
description:
Dec 23 21:08:18 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.33, lip=66.85.158.92, session=<yzY4VaBGD4Ve584h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.110
country_id: 1814991
description:
Dec 23 21:08:32 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.110, lip=66.85.158.92, session=<gLAPVqBGT8Re585u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.104
country_id: 1814991
description:
Dec 23 21:08:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.104, lip=66.85.158.92, session=<xkZEVqBGD6Re585o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.136
country_id: 6252001
description:
Dec 23 21:07:40 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=162.216.150.136, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<JkfwUqBGwOai2JaI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 23 21:08:49 host2 sshd[1103069]: Disconnected from invalid user admin 36.255.223.75 port 36978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-23 21:08:51 dovecot_login authenticator failed for H=([65.20.143.159]) [65.20.143.159]:49051: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-23 21:09:09 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:55794: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.5.135
country_id: 6252001
description:
Dec 23 21:08:38 host2 sshd[1102885]: Disconnected from invalid user sammy 165.227.5.135 port 55814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.136
country_id: 6252001
description:
Dec 23 21:12:02 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.136, lip=66.85.158.92, TLS, session=<FlWIYqBGaP2i2JaI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 21:14:58 host2 sshd[1109059]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.53.113
country_id: 6252001
description:
[2025-12-23 21:17:58 +0530] info [cpaneld] 70.170.53.113 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.26.90
country_id: 6252001
description:
[2025-12-23 21:18:00 +0530] info [cpaneld] 65.185.26.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.72.96.107
country_id: 6252001
description:
[2025-12-23 21:18:03 +0530] info [cpaneld] 68.72.96.107 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.200.157.8
country_id: 6252001
description:
[2025-12-23 21:18:04 +0530] info [whostmgrd] 47.200.157.8 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.122.67
country_id: 6252001
description:
[2025-12-23 21:18:05 +0530] info [cpaneld] 47.158.122.67 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.173.61.168
country_id: 6252001
description:
[2025-12-23 21:18:07 +0530] info [cpaneld] 173.173.61.168 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.71.100.102
country_id: 6252001
description:
[2025-12-23 21:18:08 +0530] info [cpaneld] 208.71.100.102 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-23 21:21:40 dovecot_login authenticator failed for H=(177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:49481: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-23 21:22:08 dovecot_login authenticator failed for H=([149.54.15.42]) [149.54.15.42]:48863: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.80.103
country_id: 1269750
description:
Dec 23 21:23:13 host2 sshd[1116677]: Disconnected from invalid user mediamanager_playerssistemas 68.183.80.103 port 60926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.80.103
country_id: 1269750
description:
Dec 23 21:24:10 host2 sshd[1117472]: Disconnected from invalid user mediamanager_playerssistemas 68.183.80.103 port 32806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.80.103
country_id: 1269750
description:
Dec 23 21:24:46 host2 sshd[1117948]: Disconnected from invalid user syntex_websyntex 68.183.80.103 port 41774 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Dec 23 21:29:05 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VCiKn6BGi9Wi2JZ8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Dec 23 21:29:42 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<Yxy2oaBGEvqi2JZ8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.147.162.215
country_id: 3686110
description:
Dec 23 21:30:17 host2 sshd[1123453]: Disconnected from invalid user sshtunnel 186.147.162.215 port 44456 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.131.42
country_id: 6252001
description:
Dec 23 21:32:17 host2 sshd[1125366]: Disconnected from invalid user testuser 198.46.131.42 port 49760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.131.42
country_id: 6252001
description:
Dec 23 21:32:52 host2 sshd[1125888]: Disconnected from invalid user develop 198.46.131.42 port 34000 [preauth]


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 23 21:35:17 host2 dovecot[1133349]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Dec 23 21:35:01 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS, session=<H4DFtKBGXPii2JZ8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.252.157.122
country_id: 1643084
description:
Dec 23 21:36:50 host2 sshd[1135196]: Disconnected from invalid user es 180.252.157.122 port 35442 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.225
country_id: 6252001
description:
Dec 23 21:37:30 host2 pure-ftpd[1135795]: (?@198.235.24.225) [INFO] New connection from 198.235.24.225


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 23 21:40:16 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<bXmLx6BGDvW4affD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.252.157.122
country_id: 1643084
description:
Dec 23 21:40:08 host2 sshd[1137621]: Disconnected from invalid user arun 180.252.157.122 port 52518 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 23 21:40:44 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<aEMuyaBGQvC4affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-23 21:42:45 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:46168: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-23 21:43:08 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:39904: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Dec 23 21:45:36 host2 sshd[1140621]: Disconnected from invalid user user10 212.11.64.164 port 46802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.208
country_id: 3865483
description:
Dec 23 21:45:49 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=186.190.167.208, lip=66.85.158.91, TLS, session=<mdY52qBGRN+6vqfQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.10.196.106
country_id: 3469034
description:
Dec 23 21:46:09 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=177.10.196.106, lip=66.85.158.91, TLS, session=<aJOJ26BGapixCsRq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.102.191.51
country_id: 2589581
description:
2025-12-23 21:47:16 dovecot_plain authenticator failed for H=(V4836VC8A) [41.102.191.51]:52186: 535 Incorrect authentication data (set_id=virajith.rathnasekara@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.147.162.215
country_id: 3686110
description:
Dec 23 21:46:52 host2 sshd[1141364]: Disconnected from invalid user sinusbot 186.147.162.215 port 38004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-23 21:48:20 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:42450: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-23 21:48:34 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:59954: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Dec 23 21:48:42 host2 sshd[1142516]: Disconnected from invalid user mapadmin 212.11.64.164 port 47094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-23 21:48:46 dovecot_login authenticator failed for H=([128.185.235.110]) [128.185.235.110]:42098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-12-23 21:49:06 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:47970: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-23 21:49:44 +0530] info [cpaneld] 89.249.55.106 - dataesit "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Dec 23 21:49:51 host2 sshd[1143219]: Disconnected from invalid user hadoop 212.11.64.164 port 40054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.11.64.164
country_id: 241170
description:
Dec 23 21:50:24 host2 sshd[1143908]: Disconnected from invalid user joel 212.11.64.164 port 53834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 23 21:52:51 host2 sshd[1145530]: Disconnected from invalid user user1 165.154.200.14 port 56284 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 23 21:55:16 host2 sshd[1147626]: Disconnected from invalid user ftpuser 165.154.200.14 port 52418 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.94.85.169
country_id: 6252001
description:
[2025-12-23 21:55:59 +0530] info [cpaneld] 71.94.85.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.197.135.173
country_id: 6252001
description:
[2025-12-23 21:56:07 +0530] info [cpaneld] 73.197.135.173 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.97.161.169
country_id: 6252001
description:
[2025-12-23 21:56:03 +0530] info [cpaneld] 152.97.161.169 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.13.41
country_id: 6252001
description:
[2025-12-23 21:56:05 +0530] info [whostmgrd] 47.147.13.41 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.170.244
country_id: 6252001
description:
[2025-12-23 21:56:06 +0530] info [cpaneld] 172.59.170.244 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.176.223.84
country_id: 6252001
description:
[2025-12-23 21:56:10 +0530] info [cpaneld] 75.176.223.84 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.228.75.15
country_id: 6252001
description:
[2025-12-23 21:56:02 +0530] info [cpaneld] 68.228.75.15 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 22:00:24 host2 pure-ftpd[1155248]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-12-23 22:02:33 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:45362: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 193.149.189.234
country_id: 2635167
description:
Dec 23 22:02:21 host2 pure-ftpd[1166046]: (?@193.149.189.234) [INFO] New connection from 193.149.189.234


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.133.147.134
country_id: 6252001
description:
[2025-12-23 22:03:34 +0530] info [cpaneld] 69.133.147.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.27.35
country_id: 6252001
description:
[2025-12-23 22:03:35 +0530] info [cpaneld] 76.90.27.35 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.166.27.103
country_id: 6252001
description:
[2025-12-23 22:03:36 +0530] info [whostmgrd] 98.166.27.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.116.118.22
country_id: 6252001
description:
[2025-12-23 22:03:32 +0530] info [cpaneld] 73.116.118.22 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.133.126.200
country_id: 6252001
description:
[2025-12-23 22:03:37 +0530] info [cpaneld] 73.133.126.200 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.188.137
country_id: 6252001
description:
[2025-12-23 22:03:36 +0530] info [cpaneld] 71.38.188.137 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.184.111.142
country_id: 6252001
description:
[2025-12-23 22:03:38 +0530] info [cpaneld] 72.184.111.142 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 23 22:04:45 host2 sshd[1167599]: Disconnected from invalid user ociisprd 158.174.210.161 port 21063 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.8.84.144
country_id: 6252001
description:
[2025-12-23 22:05:16 +0530] info [cpaneld] 100.8.84.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.150.33
country_id: 6252001
description:
[2025-12-23 22:05:18 +0530] info [cpaneld] 76.141.150.33 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.228.59.75
country_id: 6252001
description:
[2025-12-23 22:05:19 +0530] info [whostmgrd] 71.228.59.75 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.6.91
country_id: 6252001
description:
[2025-12-23 22:05:20 +0530] info [cpaneld] 35.151.6.91 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.198.52
country_id: 6252001
description:
[2025-12-23 22:05:23 +0530] info [cpaneld] 172.89.198.52 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.174.30.196
country_id: 6252001
description:
[2025-12-23 22:05:17 +0530] info [cpaneld] 192.174.30.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.162.212.139
country_id: 6252001
description:
[2025-12-23 22:05:21 +0530] info [cpaneld] 70.162.212.139 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 23 22:07:18 host2 sshd[1169450]: Disconnected from invalid user vpn 158.174.210.161 port 49769 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Dec 23 22:08:29 host2 sshd[1170550]: Disconnected from invalid user tv 188.166.104.136 port 43868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 23 22:08:33 host2 sshd[1170594]: Disconnected from invalid user work 103.191.14.210 port 49390 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 23 22:09:12 host2 sshd[1171132]: Disconnected from invalid user kamal 158.174.210.161 port 57829 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-23 22:09:28 dovecot_login authenticator failed for H=(nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:49584: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Dec 23 22:10:23 host2 sshd[1172258]: Disconnected from invalid user prueba 188.166.104.136 port 44110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 23 22:11:58 host2 sshd[1173411]: Disconnected from invalid user backend 158.174.210.161 port 48226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Dec 23 22:12:21 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.59, lip=66.85.158.91, TLS: Connection closed, session=<8s48OqFGfH6nXpI7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 23 22:14:10 host2 sshd[1175652]: Disconnected from invalid user ftpuser 165.154.205.128 port 52594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 23 22:13:49 host2 sshd[1175297]: Disconnected from invalid user bg 103.191.14.210 port 59274 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 23 22:16:27 host2 sshd[1177803]: Disconnected from invalid user aaa 103.191.14.210 port 35426 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.53.160
country_id: 6252001
description:
[2025-12-23 22:16:29 +0530] info [cpaneld] 65.185.53.160 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.194.110
country_id: 6252001
description:
[2025-12-23 22:16:36 +0530] info [cpaneld] 76.38.194.110 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.228.39.11
country_id: 6252001
description:
[2025-12-23 22:16:35 +0530] info [cpaneld] 162.228.39.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.158.84
country_id: 6252001
description:
[2025-12-23 22:16:38 +0530] info [cpaneld] 172.117.158.84 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.68.10
country_id: 6252001
description:
[2025-12-23 22:16:37 +0530] info [whostmgrd] 69.181.68.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.90.228.161
country_id: 6252001
description:
[2025-12-23 22:16:40 +0530] info [cpaneld] 207.90.228.161 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.144.101
country_id: 6252001
description:
[2025-12-23 22:16:39 +0530] info [cpaneld] 35.150.144.101 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 23 22:17:20 host2 sshd[1178869]: Disconnected from invalid user ubuntu 198.98.56.205 port 59818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 23 22:19:02 host2 sshd[1180095]: Disconnected from invalid user alex 198.98.56.205 port 48816 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.187.73.152
country_id: 6252001
description:
[2025-12-23 22:19:02 +0530] info [cpaneld] 24.187.73.152 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.254.16
country_id: 6252001
description:
[2025-12-23 22:18:54 +0530] info [cpaneld] 129.222.254.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.193.94.106
country_id: 6252001
description:
[2025-12-23 22:18:55 +0530] info [cpaneld] 64.193.94.106 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.87.131.165
country_id: 6252001
description:
[2025-12-23 22:18:58 +0530] info [whostmgrd] 97.87.131.165 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.90.79.155
country_id: 6252001
description:
[2025-12-23 22:19:01 +0530] info [cpaneld] 75.90.79.155 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.80.247.131
country_id: 6252001
description:
[2025-12-23 22:18:57 +0530] info [cpaneld] 108.80.247.131 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.2.140.203
country_id: 6252001
description:
[2025-12-23 22:19:00 +0530] info [cpaneld] 172.2.140.203 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-23 22:19:47 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:34118: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-23 22:20:02 dovecot_login authenticator failed for H=([59.98.144.36]) [59.98.144.36]:33632: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 22:22:19 host2 sshd[1182902]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.159.21.71
country_id: 6252001
description:
[2025-12-23 22:23:15 +0530] info [webmaild] 45.159.21.71 - info@melanifinefood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.220.195.133
country_id: 2017370
description:
[2025-12-23 22:24:09 +0530] info [webmaild] 77.220.195.133 - info@ceylondigest.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Dec 23 22:25:40 host2 sshd[1185824]: Disconnected from invalid user bg 188.166.104.136 port 44394 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.202.12.11
country_id: 294640
description:
[2025-12-23 22:25:47 +0530] info [webmaild] 193.202.12.11 - info@secondcoffeeinternational.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.211.129.82
country_id: 6252001
description:
Dec 23 22:26:41 host2 pure-ftpd[1186550]: (?@54.211.129.82) [INFO] New connection from 54.211.129.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-23 22:29:24 dovecot_login authenticator failed for H=([103.163.44.118]) [103.163.44.118]:59232: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-23 22:29:28 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:41086: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-23 22:29:40 dovecot_login authenticator failed for H=92.40.62.72.threembb.co.uk [92.40.62.72]:55526: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-23 22:29:44 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:55117: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-23 22:30:20 dovecot_login authenticator failed for H=([149.54.15.42]) [149.54.15.42]:33437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-23 22:31:26 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:37955: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 23 22:34:24 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, session=<dj0aiaFG9HS4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.252
country_id: 6252001
description:
Dec 23 22:34:50 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.252, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Su6viqFGpMm4aff8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 23 22:34:51 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, session=<uKC9iqFGtHe4affD>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.149.206.34
country_id: 6252001
description:
[2025-12-23 22:36:52 +0530] info [cpaneld] 98.149.206.34 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.11.245.80
country_id: 6252001
description:
[2025-12-23 22:36:54 +0530] info [cpaneld] 99.11.245.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.196.24.38
country_id: 6252001
description:
[2025-12-23 22:36:56 +0530] info [cpaneld] 72.196.24.38 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.115.101.27
country_id: 6252001
description:
[2025-12-23 22:36:58 +0530] info [cpaneld] 68.115.101.27 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.210.121.164
country_id: 6252001
description:
[2025-12-23 22:36:57 +0530] info [whostmgrd] 107.210.121.164 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.174.220.18
country_id: 6252001
description:
[2025-12-23 22:37:00 +0530] info [cpaneld] 99.174.220.18 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.212.135.253
country_id: 6252001
description:
[2025-12-23 22:37:01 +0530] info [cpaneld] 98.212.135.253 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.33.184.143
country_id: 6252001
description:
[2025-12-23 22:41:09 +0530] info [whostmgrd] 162.33.184.143 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.226.23.224
country_id: 6252001
description:
[2025-12-23 22:41:10 +0530] info [cpaneld] 131.226.23.224 - kamechotechcom "GET /login/?login_only=1&user=kamechotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.70.98.24
country_id: 6252001
description:
[2025-12-23 22:41:12 +0530] info [cpaneld] 73.70.98.24 - kamechot "GET /login/?login_only=1&user=kamechot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.21.212
country_id: 6252001
description:
[2025-12-23 22:41:19 +0530] info [cpaneld] 74.244.21.212 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.226.154.72
country_id: 6252001
description:
[2025-12-23 22:41:21 +0530] info [cpaneld] 75.226.154.72 - kamecho2 "GET /login/?login_only=1&user=kamecho2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.173.207
country_id: 6252001
description:
[2025-12-23 22:41:05 +0530] info [cpaneld] 71.202.173.207 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.170.101.50
country_id: 6252001
description:
[2025-12-23 22:41:07 +0530] info [cpaneld] 148.170.101.50 - kamechotech "GET /login/?login_only=1&user=kamechotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.57.19.81
country_id: 6252001
description:
[2025-12-23 22:41:18 +0530] info [cpaneld] 204.57.19.81 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.200.169
country_id: 6252001
description:
[2025-12-23 22:41:13 +0530] info [cpaneld] 172.89.200.169 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.21.168.169
country_id: 6252001
description:
[2025-12-23 22:41:14 +0530] info [cpaneld] 38.21.168.169 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.33.128.82
country_id: 6252001
description:
[2025-12-23 22:41:16 +0530] info [cpaneld] 73.33.128.82 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.141.174
country_id: 6252001
description:
[2025-12-23 22:41:06 +0530] info [cpaneld] 104.32.141.174 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.55.162.234
country_id: 6252001
description:
[2025-12-23 22:41:15 +0530] info [cpaneld] 184.55.162.234 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.207.199.13
country_id: 6252001
description:
[2025-12-23 22:41:20 +0530] info [cpaneld] 98.207.199.13 - kamecho1 "GET /login/?login_only=1&user=kamecho1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-23 22:42:11 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:44200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-23 22:42:38 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:52015: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.92
country_id: 6252001
description:
Dec 23 22:43:18 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.92, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PhruqKFGdMIs3Llc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.155.165.37
country_id: 6252001
description:
[2025-12-23 22:46:06 +0530] info [cpaneld] 24.155.165.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.44.201.33
country_id: 6252001
description:
[2025-12-23 22:46:04 +0530] info [cpaneld] 24.44.201.33 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.102.171
country_id: 6252001
description:
[2025-12-23 22:46:11 +0530] info [cpaneld] 73.151.102.171 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.192.100.130
country_id: 6252001
description:
[2025-12-23 22:46:12 +0530] info [cpaneld] 98.192.100.130 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.8.146.20
country_id: 6252001
description:
[2025-12-23 22:46:17 +0530] info [cpaneld] 73.8.146.20 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.194.251
country_id: 6252001
description:
[2025-12-23 22:46:19 +0530] info [cpaneld] 73.170.194.251 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.93.125.53
country_id: 6252001
description:
[2025-12-23 22:46:08 +0530] info [cpaneld] 64.93.125.53 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.59.186.119
country_id: 6252001
description:
[2025-12-23 22:46:11 +0530] info [cpaneld] 108.59.186.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.52.52.248
country_id: 6252001
description:
[2025-12-23 22:46:12 +0530] info [cpaneld] 136.52.52.248 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.210.80.2
country_id: 6252001
description:
[2025-12-23 22:46:14 +0530] info [cpaneld] 24.210.80.2 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.205.10.98
country_id: 6252001
description:
[2025-12-23 22:46:16 +0530] info [cpaneld] 68.205.10.98 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.124.66.188
country_id: 6252001
description:
[2025-12-23 22:46:09 +0530] info [whostmgrd] 73.124.66.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.36.251.124
country_id: 6252001
description:
[2025-12-23 22:46:13 +0530] info [cpaneld] 50.36.251.124 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.67.17.122
country_id: 6252001
description:
[2025-12-23 22:46:15 +0530] info [whostmgrd] 99.67.17.122 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.136.92
country_id: 2963597
description:
Dec 23 22:47:22 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=89.106.136.92, lip=66.85.158.91, TLS, session=<5BaLtqFGZeFZaohc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 22:47:20 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56899: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.50
country_id: 6252001
description:
Dec 23 22:48:38 host2 pure-ftpd[1201932]: (?@205.210.31.50) [INFO] New connection from 205.210.31.50


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.248
country_id: 3865483
description:
Dec 23 22:47:44 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=190.181.90.248, lip=66.85.158.91, TLS, session=<iteot6FG+Jq+tVr4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.140.209.83
country_id: 6252001
description:
[2025-12-23 22:50:21 +0530] info [cpaneld] 107.140.209.83 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.111.148
country_id: 6252001
description:
[2025-12-23 22:50:25 +0530] info [whostmgrd] 97.170.111.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.233.74
country_id: 6252001
description:
[2025-12-23 22:50:23 +0530] info [cpaneld] 76.175.233.74 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.92.106
country_id: 6252001
description:
[2025-12-23 22:50:26 +0530] info [cpaneld] 172.56.92.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.115.6.173
country_id: 6252001
description:
[2025-12-23 22:50:28 +0530] info [cpaneld] 71.115.6.173 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.14.46
country_id: 6252001
description:
[2025-12-23 22:50:27 +0530] info [cpaneld] 71.202.14.46 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.227.184.194
country_id: 6252001
description:
[2025-12-23 22:50:22 +0530] info [cpaneld] 66.227.184.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.233
country_id: 2635167
description:
Dec 23 22:52:35 host2 dovecot[1133416]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.233, lip=66.85.158.91, TLS, session=<6vwjyqFG05C594np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.77
country_id: 2635167
description:
Dec 23 22:52:36 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.77, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DJ41yqFGT8+594lN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.92
country_id: 2635167
description:
Dec 23 22:53:09 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.92, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<AwAxzKFGnblX7LBc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Dec 23 22:53:42 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<N3QszqFGS8FX7LBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.87
country_id: 2635167
description:
Dec 23 22:54:16 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.87, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<mMsn0KFGU5W594lX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.75
country_id: 2635167
description:
Dec 23 22:54:49 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.75, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<8S0j0qFGYYO594lL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.86
country_id: 2635167
description:
Dec 23 22:55:22 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.86, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Q54c1KFGF7tX7LBW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.106.231
country_id: 1269750
description:
Dec 23 22:55:28 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.87.106.231, lip=66.85.158.91, TLS, session=<Ye5i06FGLodnV2rn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-23 22:55:35 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:45214: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.67
country_id: 3175395
description:
Dec 23 22:55:46 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.67, lip=66.85.158.91, TLS, session=<itCJ1KFGs+i5xQlD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-23 22:55:57 dovecot_login authenticator failed for H=(cm-178.232.147.85.get.no) [178.232.147.85]:43106: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.81
country_id: 2635167
description:
Dec 23 22:55:55 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.81, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<zw4a1qFGS9S594lR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.75
country_id: 2635167
description:
Dec 23 22:56:29 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.75, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<4VIV2KFGQ9O594lL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.103
country_id: 2635167
description:
Dec 23 22:57:35 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.103, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<ARoK3KFGJ4lX7LBn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.74
country_id: 2635167
description:
Dec 23 22:57:02 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.74, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<i7gO2qFGE85X7LBK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-12-23 22:57:51 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:59432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-23 22:58:04 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:43522: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-23 22:58:57 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:55095: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-23 22:59:45 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:49889: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.71
country_id: 6252001
description:
Dec 23 23:00:09 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.71, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xr085aFGW61BMQFH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Dec 23 23:00:26 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PeU05qFGJFNBMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Dec 23 23:00:41 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS: Connection closed, session=<+3AY56FGvi9BMQFC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 23:03:08 host2 pure-ftpd[1216026]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 23:10:23 host2 sshd[1223544]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 23:11:04 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<2oUjDKJGorPBHmEh>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.233.220.43
country_id: 6252001
description:
[2025-12-23 23:12:49 +0530] info [webmaild] 193.233.220.43 - info@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-23 23:14:43 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:42029: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.152
country_id: 1643084
description:
Dec 23 23:14:51 host2 sshd[1227807]: Disconnected from invalid user vivek 103.13.206.152 port 57068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2025-12-23 23:15:16 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:48312: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.152
country_id: 1643084
description:
Dec 23 23:15:37 host2 sshd[1228670]: Disconnected from invalid user arthur 103.13.206.152 port 42628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.152
country_id: 1643084
description:
Dec 23 23:16:59 host2 sshd[1229455]: Disconnected from invalid user kibana 103.13.206.152 port 54808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 23 23:18:15 host2 sshd[1230323]: Disconnected from invalid user git 202.165.22.246 port 49488 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-23 23:18:29 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:39350: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 23 23:20:34 host2 sshd[1232299]: Disconnected from invalid user admin 202.165.22.246 port 58822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 23 23:21:52 host2 sshd[1233250]: Disconnected from invalid user frappe 202.165.22.246 port 58234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-23 23:22:10 dovecot_login authenticator failed for H=([152.52.234.170]) [182.95.177.78]:47880: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 23 23:22:21 host2 sshd[1233560]: Disconnected from invalid user mgeweb 45.78.225.21 port 59846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-23 23:22:33 dovecot_login authenticator failed for H=([128.185.223.87]) [182.95.178.154]:41644: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 23 23:23:10 host2 sshd[1234156]: Disconnected from invalid user ovpn 181.116.220.11 port 49611 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 23 23:24:22 host2 sshd[1235079]: Disconnected from invalid user tmp 181.116.220.11 port 54366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 23 23:28:31 host2 sshd[1238409]: Disconnected from invalid user opc 45.78.225.21 port 47902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 23 23:29:47 host2 sshd[1239259]: Disconnected from invalid user myuser 45.78.225.21 port 43924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:33:25 host2 sshd[1242423]: Disconnected from invalid user huawei 41.74.172.237 port 33768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 23 23:35:05 host2 sshd[1243890]: Disconnected from invalid user apps 158.69.204.92 port 46600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:36:15 host2 sshd[1244981]: Disconnected from invalid user test 41.74.172.237 port 45182 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.66.208.108
country_id: 2017370
description:
[2025-12-23 23:36:23 +0530] info [webmaild] 45.66.208.108 - info@weeratrading.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 23 23:37:06 host2 sshd[1245621]: Disconnected from invalid user thomas 158.69.204.92 port 43684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 23 23:38:35 host2 sshd[1246695]: Disconnected from invalid user test 158.69.204.92 port 40296 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 23 23:39:34 host2 sshd[1247779]: Received disconnect from 158.69.204.92 port 44690:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:39:49 host2 sshd[1248004]: Disconnected from invalid user mark 41.74.172.237 port 60346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:41:20 host2 sshd[1249839]: Disconnected from invalid user usher 41.74.172.237 port 39588 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.134.140.229
country_id: 6252001
description:
[2025-12-23 23:42:12 +0530] info [webmaild] 45.134.140.229 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:42:42 host2 sshd[1251070]: Disconnected from invalid user z 41.74.172.237 port 38340 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.35.34.168
country_id: 6252001
description:
[2025-12-23 23:44:25 +0530] info [cpaneld] 98.35.34.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.180.42
country_id: 6252001
description:
[2025-12-23 23:44:28 +0530] info [cpaneld] 47.147.180.42 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.5.166.73
country_id: 6252001
description:
[2025-12-23 23:44:32 +0530] info [cpaneld] 107.5.166.73 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.29.171.226
country_id: 6252001
description:
[2025-12-23 23:44:34 +0530] info [cpaneld] 108.29.171.226 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.237
country_id: 6252001
description:
Dec 23 23:44:35 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.237, lip=66.85.158.91, session=<gSAghKJGd9xAPsXt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.23.68.156
country_id: 6252001
description:
[2025-12-23 23:44:29 +0530] info [whostmgrd] 70.23.68.156 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.43.167.9
country_id: 6252001
description:
[2025-12-23 23:44:33 +0530] info [cpaneld] 50.43.167.9 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.184.224.82
country_id: 6252001
description:
[2025-12-23 23:44:26 +0530] info [cpaneld] 192.184.224.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Dec 23 23:44:46 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.91, TLS: Connection closed, session=<2n/DhKJGJIhAPsXj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.234
country_id: 3996063
description:
2025-12-23 23:54:22 dovecot_login authenticator failed for H=(201.173.216.234-clientes-izzi.mx) [201.173.216.234]:37317: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.232.107
country_id: 294640
description:
[2025-12-23 23:57:40 +0530] info [webmaild] 45.148.232.107 - info@kiriaswanu.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.20.157.103
country_id: 6252001
description:
[2025-12-24 00:03:21 +0530] info [cpaneld] 174.20.157.103 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.169.114.248
country_id: 6252001
description:
[2025-12-24 00:03:22 +0530] info [whostmgrd] 184.169.114.248 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.8.147.213
country_id: 6252001
description:
[2025-12-24 00:03:26 +0530] info [cpaneld] 76.8.147.213 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.16.131
country_id: 3865483
description:
Dec 24 00:03:35 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.117.16.131, lip=66.85.158.91, TLS, session=<yf4Bx6JG1oOKdRCD>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.90.251.231
country_id: 6252001
description:
[2025-12-24 00:03:25 +0530] info [cpaneld] 97.90.251.231 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.121.132.56
country_id: 6252001
description:
[2025-12-24 00:03:30 +0530] info [cpaneld] 64.121.132.56 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.18
country_id: 1269750
description:
Dec 24 00:03:15 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.237.58.18, lip=66.85.158.91, TLS, session=<GVC/xaJGGMVn7ToS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.194.65.184
country_id: 6252001
description:
[2025-12-24 00:03:18 +0530] info [cpaneld] 76.194.65.184 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.43
country_id: 6252001
description:
[2025-12-24 00:03:20 +0530] info [cpaneld] 172.58.167.43 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.16.20.103
country_id: 6252001
description:
[2025-12-24 00:06:30 +0530] info [whostmgrd] 24.16.20.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.160.98.186
country_id: 6252001
description:
[2025-12-24 00:06:32 +0530] info [cpaneld] 70.160.98.186 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.29.157.192
country_id: 6252001
description:
[2025-12-24 00:06:35 +0530] info [cpaneld] 50.29.157.192 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 00:05:45 host2 pure-ftpd[1275961]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.211.239.76
country_id: 6252001
description:
[2025-12-24 00:06:26 +0530] info [cpaneld] 72.211.239.76 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.240.253.203
country_id: 6252001
description:
[2025-12-24 00:06:25 +0530] info [cpaneld] 70.240.253.203 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.102.152.71
country_id: 6252001
description:
[2025-12-24 00:06:27 +0530] info [cpaneld] 50.102.152.71 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-24 00:08:09 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:58846: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.34
country_id: 1269750
description:
Dec 24 00:08:25 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=103.30.83.34, lip=66.85.158.91, TLS, session=<G7JA2KJGa45nHlMi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.85
country_id: 6252001
description:
Dec 24 00:08:36 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.85, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gNME2qJG+tLG6xhV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-24 00:07:46 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:59465: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.53
country_id: 1269750
description:
Dec 24 00:08:04 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=103.18.166.53, lip=66.85.158.91, TLS, session=<PZfx1qJGQrVnEqY1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.173.180.62
country_id: 6252001
description:
[2025-12-24 00:09:03 +0530] info [cpaneld] 73.173.180.62 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.16.226
country_id: 6252001
description:
[2025-12-24 00:09:06 +0530] info [cpaneld] 73.41.16.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.196.179.117
country_id: 6252001
description:
[2025-12-24 00:09:09 +0530] info [whostmgrd] 151.196.179.117 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.73.177.202
country_id: 6252001
description:
[2025-12-24 00:09:07 +0530] info [cpaneld] 71.73.177.202 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.44.186.208
country_id: 6252001
description:
[2025-12-24 00:09:11 +0530] info [cpaneld] 73.44.186.208 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.14.136
country_id: 6252001
description:
[2025-12-24 00:09:14 +0530] info [cpaneld] 47.154.14.136 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.35.141.6
country_id: 6252001
description:
[2025-12-24 00:09:13 +0530] info [cpaneld] 24.35.141.6 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 24 00:10:21 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, session=<e3tJ4KJGwt9KUi8F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-24 00:10:26 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:43111: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.147
country_id: 6252001
description:
Dec 24 00:10:34 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.147, lip=66.85.158.92, TLS handshaking: Connection closed, session=<67MJ4aJG4ahBMQGT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 24 00:10:50 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, session=<MX/64aJGUjVKUi8F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Dec 24 00:10:52 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<BJ4Z4qJGEnRBMQGO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-24 00:10:59 dovecot_login authenticator failed for H=([135.13.8.246]) [74.224.215.23]:9796: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 00:17:13 host2 sshd[1286125]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.36
country_id: 1819730
description:
Dec 24 00:29:26 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.36, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<uaCIJKNGbLktjpok>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.84.219.189
country_id: 6252001
description:
[2025-12-24 00:29:56 +0530] info [cpaneld] 71.84.219.189 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.251.44.5
country_id: 6252001
description:
[2025-12-24 00:29:43 +0530] info [cpaneld] 162.251.44.5 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.53.172.238
country_id: 6252001
description:
[2025-12-24 00:29:51 +0530] info [cpaneld] 24.53.172.238 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.220.75.144
country_id: 6252001
description:
[2025-12-24 00:29:48 +0530] info [cpaneld] 97.220.75.144 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.34.80.152
country_id: 6252001
description:
[2025-12-24 00:29:50 +0530] info [whostmgrd] 136.34.80.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.145.204.190
country_id: 6252001
description:
[2025-12-24 00:29:54 +0530] info [cpaneld] 73.145.204.190 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.36
country_id: 1819730
description:
Dec 24 00:29:28 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.36, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<F5mnJKNGPr8tjpok>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.37.44.175
country_id: 6252001
description:
[2025-12-24 00:29:41 +0530] info [cpaneld] 136.37.44.175 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 00:34:20 host2 sshd[1299419]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.249
country_id: 6252001
description:
Dec 24 00:34:20 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.249, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ISgNNqNGudnG6xj5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.118.3
country_id: 3017382
description:
Dec 24 00:35:56 host2 sshd[1301114]: Disconnected from invalid user ubuntu 141.95.118.3 port 53548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.217.192
country_id: 6252001
description:
Dec 24 00:36:16 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.234.217.192, lip=66.85.158.91, session=<Kv72PKNG6qKs6tnA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.89.240.251
country_id: 1210997
description:
Dec 24 00:37:25 host2 sshd[1302220]: Disconnected from invalid user bodega 103.89.240.251 port 44508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 24 00:36:35 host2 sshd[1301638]: Disconnected from invalid user ubuntu 172.174.72.225 port 36130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.118.3
country_id: 3017382
description:
Dec 24 00:38:55 host2 sshd[1303226]: Disconnected from invalid user rtc 141.95.118.3 port 36316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 24 00:39:05 host2 sshd[1303389]: Disconnected from invalid user webuser 172.174.72.225 port 34872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.89.240.251
country_id: 1210997
description:
Dec 24 00:38:41 host2 sshd[1303092]: Disconnected from invalid user exploit 103.89.240.251 port 54668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.95.118.3
country_id: 3017382
description:
Dec 24 00:40:33 host2 sshd[1304564]: Disconnected from invalid user hadoop 141.95.118.3 port 48542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 24 00:41:55 host2 sshd[1305385]: Disconnected from invalid user exploit 103.186.0.68 port 38042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 24 00:42:38 host2 sshd[1305954]: Disconnected from invalid user loginuser 103.186.0.68 port 56864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.194
country_id: 3469034
description:
Dec 24 00:44:04 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=177.130.170.194, lip=66.85.158.91, TLS, session=<PJS3V6NGu8GxgqrC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.179
country_id: 3469034
description:
Dec 24 00:44:26 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.179, lip=66.85.158.91, TLS, session=<XgMBWaNGp5q+WYiz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-24 00:46:09 dovecot_login authenticator failed for H=(82-102-165-200.orange.net.il) [82.102.165.200]:38136: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-24 00:46:23 dovecot_login authenticator failed for H=([128.185.80.65]) [182.95.52.122]:35044: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-24 00:45:31 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:35526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-24 00:46:04 dovecot_login authenticator failed for H=([189.80.46.250]) [189.80.46.250]:40364: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 24 00:46:50 host2 sshd[1309253]: Disconnected from invalid user alex 103.186.0.68 port 49388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-24 00:48:13 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:39552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 24 00:47:37 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<CASNZaNG2uLPWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.96
country_id: 3996063
description:
2025-12-24 00:48:32 dovecot_login authenticator failed for H=(201.173.216.96-clientes-izzi.mx) [201.173.216.96]:53324: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-24 00:50:11 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:56076: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-24 00:50:34 dovecot_login authenticator failed for H=([196.28.226.66]) [196.28.226.66]:39054: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 24 01:02:53 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<gN0hnKNGSpxChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 24 01:03:57 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<g6b5nqNG65bJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.144
country_id: 1269750
description:
Dec 24 01:04:17 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=103.213.195.144, lip=66.85.158.91, TLS, session=<egUboKNGBcFn1cOQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 01:04:31 host2 sshd[1326242]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2025-12-24 01:06:56 dovecot_login authenticator failed for H=([127.0.0.1]) [24.232.114.16]:40591: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.91.148.232
country_id: 298795
description:
2025-12-24 01:07:23 dovecot_login authenticator failed for H=([127.0.0.1]) [176.91.148.232]:33374: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 01:08:11 host2 pure-ftpd[1330140]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-24 01:14:21 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:53745: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-12-24 01:14:36 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:37992: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 24.199.97.179
country_id: 6252001
description:
Dec 24 01:18:35 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=24.199.97.179, lip=66.85.158.91, TLS, session=<NxlF1KNG5q4Yx2Gz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.14
country_id: 798549
description:
Dec 24 01:23:31 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=212.73.148.14, lip=66.85.158.91, TLS: Connection closed, session=<04zr5aNG3ovUSZQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.6.111
country_id: 690791
description:
Dec 24 01:26:24 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=176.103.6.111, lip=66.85.158.91, TLS, session=<b9M076NGl8iwZwZv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.25.132.38
country_id: 1269750
description:
Dec 24 01:26:44 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.25.132.38, lip=66.85.158.91, TLS, session=<mdlX8KNGipZnGYQm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.184
country_id: 6252001
description:
Dec 24 01:28:51 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4bgI+aNGa9fG6xi4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.75
country_id: 6252001
description:
Dec 24 01:28:55 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=147.185.132.75, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dqY3+aNGGd6TuYRL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-24 01:38:57 dovecot_login authenticator failed for H=(cm-46.212.111.48.get.no) [46.212.111.48]:57553: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-24 01:39:27 dovecot_login authenticator failed for H=(201.173.92.229-clientes-izzi.mx) [201.173.92.229]:35352: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.100
country_id: 6252001
description:
Dec 24 01:39:35 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.100, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oG1rH6RGo8vG6xhk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-24 01:42:09 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:50308: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-24 01:42:28 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:37939: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.101.189.149
country_id: 3579143
description:
2025-12-24 01:42:32 dovecot_plain authenticator failed for H=149.189.101.199.dyn-ip.dtfibre.fr (96H3V7R8Q2) [199.101.189.149]:22574: 535 Incorrect authentication data (set_id=virajith.rathnasekara@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.231
country_id: 6252001
description:
Dec 24 02:01:13 host2 pure-ftpd[1385091]: (?@38.148.242.231) [INFO] New connection from 38.148.242.231


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 24 02:01:14 host2 sshd[1385117]: Disconnected from invalid user arma3 189.217.130.86 port 64664 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 24 02:01:50 host2 sshd[1385769]: Disconnected from invalid user guest2 189.217.130.86 port 54563 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 24 02:02:56 host2 sshd[1387047]: Disconnected from invalid user john1 189.217.130.86 port 42474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-24 02:04:42 dovecot_login authenticator failed for H=([85.117.232.42]) [85.117.232.42]:51031: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-24 02:05:04 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:45030: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-24 02:09:24 dovecot_login authenticator failed for H=109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:53388: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-24 02:09:46 dovecot_login authenticator failed for H=(201.173.92.229-clientes-izzi.mx) [201.173.92.229]:57025: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-24 02:10:17 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:53830: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 02:11:05 host2 sshd[1395983]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 02:10:40 host2 pure-ftpd[1395449]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.187
country_id: 2635167
description:
Dec 24 02:12:12 host2 dovecot[1133416]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.187, lip=66.85.158.92, TLS, session=<mzMHlKRGZYZX7LC7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.48
country_id: 2635167
description:
Dec 24 02:12:13 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.48, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1McelKRGd69X7LAw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.68
country_id: 2635167
description:
Dec 24 02:12:47 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.68, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<O08alqRGQ6NX7LBE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.61
country_id: 2635167
description:
Dec 24 02:13:20 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.61, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<4tgVmKRGsYa594k9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 24 02:14:16 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=</cBOm6RGJIDE+2YV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.71
country_id: 2635167
description:
Dec 24 02:14:26 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.71, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=</W4MnKRGl+dX7LBH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.61
country_id: 2635167
description:
Dec 24 02:13:53 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.61, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<mBsRmqRGo+2594k9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 24 02:14:29 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<xK8ZnKRG7MTE+2YY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.61
country_id: 2635167
description:
Dec 24 02:15:00 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.61, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<neMFnqRGMeBX7LA9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.89.218.40
country_id: 6252001
description:
[2025-12-24 02:16:18 +0530] info [cpaneld] 72.89.218.40 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.40
country_id: 2635167
description:
Dec 24 02:16:06 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.40, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<I5r+oaRGPd5X7LAo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.174.218.97
country_id: 6252001
description:
[2025-12-24 02:16:11 +0530] info [cpaneld] 76.174.218.97 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.76.241
country_id: 6252001
description:
[2025-12-24 02:16:15 +0530] info [whostmgrd] 73.93.76.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.162.141.59
country_id: 6252001
description:
[2025-12-24 02:16:13 +0530] info [cpaneld] 68.162.141.59 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.255.75
country_id: 6252001
description:
[2025-12-24 02:16:17 +0530] info [cpaneld] 45.51.255.75 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.46
country_id: 2635167
description:
Dec 24 02:15:33 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.46, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SksDoKRGice594ku>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.98.238.174
country_id: 6252001
description:
[2025-12-24 02:16:11 +0530] info [cpaneld] 74.98.238.174 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.134.218.96
country_id: 6252001
description:
[2025-12-24 02:16:15 +0530] info [cpaneld] 76.134.218.96 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.61
country_id: 2635167
description:
Dec 24 02:17:13 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.61, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<0HzzpaRGy8xX7LA9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.38
country_id: 2635167
description:
Dec 24 02:16:39 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<zhv4o6RGDZBX7LAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Dec 24 02:17:55 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<Wn5XqKRGntjE+2YK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 02:19:11 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56308: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.194
country_id: 3469034
description:
Dec 24 02:20:07 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=138.255.206.194, lip=66.85.158.91, TLS, session=<gCZAr6RG+cmK/87C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.134
country_id: 798544
description:
Dec 24 02:19:39 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=178.216.27.134, lip=66.85.158.91, TLS, session=<T5KvraRGG6qy2BuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.85
country_id: 953987
description:
Dec 24 02:19:46 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=102.129.62.85, lip=66.85.158.91, TLS, session=<tLTcraRG7rlmgT5V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.205
country_id: 798544
description:
Dec 24 02:19:58 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=178.216.29.205, lip=66.85.158.91, TLS, session=<Mu7HrqRGPcCy2B3N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-24 02:22:41 dovecot_login authenticator failed for H=([14.97.77.182]) [14.97.77.182]:41942: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-24 02:23:36 dovecot_login authenticator failed for H=(syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:59375: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 24 02:23:59 host2 sshd[1409049]: Disconnected from invalid user sadmin 151.49.129.67 port 46870 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 24 02:24:23 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=</4p1v6RGNK7E+2YU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.101
country_id: 1819730
description:
Dec 24 02:24:27 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.101, lip=66.85.158.92, TLS, session=<QGrfv6RGTrYtjppl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.101
country_id: 1819730
description:
Dec 24 02:24:29 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.142.154.101, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KLz7v6RGCLotjppl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-24 02:25:15 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:41924: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 24 02:25:36 host2 sshd[1410740]: Disconnected from invalid user junior 151.49.129.67 port 34030 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.109.215.6
country_id: 6252001
description:
[2025-12-24 02:28:01 +0530] info [cpaneld] 208.109.215.6 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.131
country_id: 6252001
description:
Dec 24 02:29:33 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.131, lip=66.85.158.92, session=<UgEV0qRGLM1ChJmD>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.218
country_id: 2635167
description:
Dec 24 02:31:02 host2 dovecot[1133416]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.218, lip=66.85.158.92, TLS, session=<BoZh16RGxc6594na>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Dec 24 02:31:03 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rkNt16RGO9K594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.8
country_id: 2635167
description:
Dec 24 02:31:36 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.8, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6a1o2aRGJ+y594kI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2025-12-24 02:31:36 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:55805: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-24 02:31:57 dovecot_login authenticator failed for H=(186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:32793: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.11
country_id: 2635167
description:
Dec 24 02:32:10 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.11, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<dfZz26RG78xX7LAL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Dec 24 02:32:43 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=</Ilv3aRGk5S594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.9
country_id: 2635167
description:
Dec 24 02:33:17 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.9, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<6sZq36RGTem594kJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.10
country_id: 2635167
description:
Dec 24 02:33:50 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.10, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8i1k4aRG45lX7LAK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.190.24.99
country_id: 3703430
description:
Dec 24 02:34:18 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=185.190.24.99, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oYwN46RGbf65vhhj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.25
country_id: 2635167
description:
Dec 24 02:34:23 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.25, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<o4Bh46RGj5G594kZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.11
country_id: 2635167
description:
Dec 24 02:34:56 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.11, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=</dNc5aRGY8y594kL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.163.200
country_id: 6252001
description:
[2025-12-24 02:35:21 +0530] info [cpaneld] 100.0.163.200 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.107.254.171
country_id: 6252001
description:
[2025-12-24 02:35:26 +0530] info [cpaneld] 24.107.254.171 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.80.121.157
country_id: 6252001
description:
[2025-12-24 02:35:27 +0530] info [cpaneld] 75.80.121.157 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.182.39.35
country_id: 6252001
description:
[2025-12-24 02:35:19 +0530] info [cpaneld] 67.182.39.35 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.88.78.87
country_id: 6252001
description:
[2025-12-24 02:35:22 +0530] info [cpaneld] 73.88.78.87 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.33.228
country_id: 6252001
description:
[2025-12-24 02:35:25 +0530] info [whostmgrd] 98.97.33.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.135.111.240
country_id: 6252001
description:
[2025-12-24 02:35:27 +0530] info [cpaneld] 107.135.111.240 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.4
country_id: 2635167
description:
Dec 24 02:35:30 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.4, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<LipW56RGYc9X7LAE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.13
country_id: 2635167
description:
Dec 24 02:36:03 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.13, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<ZZRR6aRGtYC594kN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 24 02:37:08 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<mZQz7aRGqMPPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.33
country_id: 6252001
description:
Dec 24 02:38:24 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.33, lip=66.85.158.92, session=<AN+58aRGe8LDuEwh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.36
country_id: 6252001
description:
Dec 24 02:38:35 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.36, lip=66.85.158.92, session=<Mr5d8qRGuZPDuEwk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.34
country_id: 6252001
description:
Dec 24 02:38:43 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.34, lip=66.85.158.92, session=</1bf8qRGo7LDuEwi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.245
country_id: 6252001
description:
Dec 24 02:38:46 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.245, lip=66.85.158.92, session=</1QP86RG1YTDuEz1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 24 02:39:09 host2 pure-ftpd[1426357]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.95.72
country_id: 798544
description:
Dec 24 02:39:39 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=78.31.95.72, lip=66.85.158.91, TLS, session=<2vMx9aRGeMZOH19I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.163.8.156
country_id: 798544
description:
Dec 24 02:39:57 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=81.163.8.156, lip=66.85.158.91, TLS, session=<I1ZJ9qRGnuhRowic>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 02:44:23 host2 sshd[1431871]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.23
country_id: 3865483
description:
Dec 24 02:49:00 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.252.23, lip=66.85.158.91, TLS, session=<7yeJFqVGDYezAPwX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.195.158
country_id: 3865483
description:
Dec 24 02:49:21 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=186.96.195.158, lip=66.85.158.91, TLS, session=<gUHKF6VGMdK6YMOe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 24 02:50:24 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<dpyCHKVGqovE+2YT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.62
country_id: 3017382
description:
Dec 24 02:53:26 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.62, lip=66.85.158.92, session=<nHd7J6VG/41b51k+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.178
country_id: 3017382
description:
Dec 24 02:53:09 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.178, lip=66.85.158.92, session=<RsGDJqVGA6tb51my>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.180
country_id: 3017382
description:
Dec 24 02:53:20 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.180, lip=66.85.158.92, session=<HecoJ6VGV41b51m0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.63
country_id: 3017382
description:
Dec 24 02:53:29 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.63, lip=66.85.158.92, session=<bN6tJ6VG+51b51k/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-24 02:54:27 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:48392: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-24 02:54:44 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:43379: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 02:58:24 host2 sshd[1446590]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.154.125
country_id: 6252001
description:
2025-12-24 02:57:53 dovecot_plain authenticator failed for H=server.ynq.bth.mybluehostin.me (localhost) [162.240.154.125]:11248: 535 Incorrect authentication data (set_id=news@ceylondigest.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.93.65.245
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.93.65.245: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 54.191.203.189
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 54.191.203.189: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-24 03:06:31 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:57522: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 24 03:09:07 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<T3edX6VGuCdChJmK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 03:12:50 host2 pure-ftpd[1461059]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.231
country_id: 6252001
description:
Dec 24 03:13:22 host2 pure-ftpd[1461844]: (?@38.148.242.231) [INFO] New connection from 38.148.242.231


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 24 03:19:19 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<x23tg6VGgsDE+2YX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 24 03:19:22 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<swIJhKVG4trE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-24 03:20:45 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:49302: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.71
country_id: 6252001
description:
Dec 24 03:21:16 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.71, lip=66.85.158.92, TLS, session=<PiIPi6VGavrG6xhH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-24 03:28:56 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:48404: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-24 03:29:16 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:42466: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.39
country_id: 1643084
description:
2025-12-24 03:31:39 dovecot_login authenticator failed for H=([127.0.0.1]) [157.15.40.39]:49886: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2025-12-24 03:31:29 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.83.15]:45093: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.252.2
country_id: 2921044
description:
Dec 24 03:39:16 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.252.2, lip=66.85.158.92, TLS, session=<U0pvy6VGts+kXPwC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-24 03:43:38 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:52541: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-24 03:44:11 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:43864: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-24 03:47:54 dovecot_login authenticator failed for H=(arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:58314: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-24 03:48:13 dovecot_login authenticator failed for H=([128.185.189.57]) [182.78.79.134]:41304: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.134.152
country_id: 6252001
description:
Dec 24 03:52:20 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.134.152, lip=66.85.158.92, TLS, session=<aXkn+qVGNqalmoaY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-24 04:02:44 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:40295: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 04:04:35 host2 sshd[1522076]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Dec 24 04:04:33 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, session=<aefYJaZG2OvG6xhl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.134.152
country_id: 6252001
description:
Dec 24 04:05:37 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.154.134.152, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JbykKaZGPtOlmoaY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.93.133.101
country_id: 6252001
description:
Dec 24 04:07:04 host2 pure-ftpd[1527222]: (?@35.93.133.101) [INFO] New connection from 35.93.133.101


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 35.92.49.13
country_id: 6252001
description:
Dec 24 04:07:35 host2 dovecot[1133416]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=35.92.49.13, lip=66.85.158.91, session=<ezu1MKZGnIcjXDEN>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.235.223
country_id: 6252001
description:
[2025-12-24 04:07:42 +0530] info [webmaild] 45.147.235.223 - info@melanifinefood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.36.12.8
country_id: 6252001
description:
Dec 24 04:08:38 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.36.12.8, lip=66.85.158.91, session=<2JtyNKZGdtE0JAwI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.233.217.216
country_id: 6252001
description:
[2025-12-24 04:08:57 +0530] info [webmaild] 193.233.217.216 - info@ceylondigest.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.202.7.229
country_id: 6252001
description:
Dec 24 04:09:05 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=54.202.7.229, lip=66.85.158.91, session=<WTILNqZGmM02ygfl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.161.59.224
country_id: 6252001
description:
Dec 24 04:09:24 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 47 secs): user=<>, rip=35.161.59.224, lip=66.85.158.91, session=<oPknN6ZGBosjoTvg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.249.49.30
country_id: 6252001
description:
Dec 24 04:09:40 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.249.49.30, lip=66.85.158.91, session=<yjEnOKZGJL4s+TEe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.219.16.5
country_id: 6252001
description:
Dec 24 04:09:44 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=34.219.16.5, lip=66.85.158.91, session=<7x5ZOKZGcKQi2xAF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.220.195.80
country_id: 2017370
description:
[2025-12-24 04:10:50 +0530] info [webmaild] 77.220.195.80 - info@secondcoffeeinternational.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.88.18.201
country_id: 6252001
description:
Dec 24 04:11:54 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 120 secs): user=<>, rip=52.88.18.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<goMhQKZGDMY0WBLJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.88.18.201
country_id: 6252001
description:
Dec 24 04:12:37 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=52.88.18.201, lip=66.85.158.91, TLS, session=<0MGmQqZGSMs0WBLJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.87.178.137
country_id: 6252001
description:
Dec 24 04:13:08 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=35.87.178.137, lip=66.85.158.91, TLS, session=<keqFRKZGLsUjV7KJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.43.196.4
country_id: 6252001
description:
Dec 24 04:13:11 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=52.43.196.4, lip=66.85.158.91, TLS, session=<6361RKZGTNY0K8QE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-24 04:14:25 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:56462: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-24 04:14:27 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:49715: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-12-24 04:13:46 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:47416: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-24 04:13:59 dovecot_login authenticator failed for H=(50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:32790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-24 04:14:02 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:39193: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.13.126.109
country_id: 6252001
description:
Dec 24 04:14:31 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 120 secs): user=<>, rip=52.13.126.109, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dml5SaZGhLM0DX5t>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 04:15:12 host2 pure-ftpd[1537240]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.27.44.27
country_id: 6252001
description:
Dec 24 04:15:34 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=52.27.44.27, lip=66.85.158.91, TLS, session=<cMg6TaZG5Io0Gywb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.54
country_id: 1643084
description:
Dec 24 04:15:36 host2 sshd[1537711]: Invalid user cloudtourssrilan_travel from 182.8.225.54 port 41395


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.219.16.5
country_id: 6252001
description:
Dec 24 04:15:36 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=34.219.16.5, lip=66.85.158.91, TLS, session=<bkZUTaZGNNEi2xAF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.54
country_id: 1643084
description:
[2025-12-24 04:15:38 +0530] info [whostmgrd] 182.8.225.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.200.203.78
country_id: 6252001
description:
[2025-12-24 04:17:59 +0530] info [whostmgrd] 107.200.203.78 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-24 04:21:53 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:53878: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-24 04:22:21 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:53232: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.209.159.36
country_id: 2921044
description:
Dec 24 04:24:02 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=213.209.159.36, lip=66.85.158.91, session=<HFpqa6ZGHqnV0Z8k>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.10
country_id: 6252001
description:
Dec 24 04:24:49 host2 pure-ftpd[1552076]: (?@147.185.132.10) [INFO] New connection from 147.185.132.10


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.11
country_id: 798549
description:
Dec 24 04:25:36 host2 pure-ftpd[1553167]: (?@85.217.149.11) [INFO] New connection from 85.217.149.11


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.11
country_id: 798549
description:
Dec 24 04:25:46 host2 pure-ftpd[1553428]: (?@85.217.149.11) [INFO] New connection from 85.217.149.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-24 04:29:24 dovecot_login authenticator failed for H=(cm-84.211.13.178.get.no) [84.211.13.178]:37515: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-24 04:29:37 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:45134: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-24 04:37:40 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:33801: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.89
country_id: 6252001
description:
Dec 24 04:45:02 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.89, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6QietqZGSsrN0h9Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-12-24 04:50:45 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:59702: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 04:51:34 host2 sshd[1590515]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-24 04:51:31 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:40020: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 24 04:52:56 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<Lwe50qZGdrbBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-24 04:53:01 dovecot_login authenticator failed for H=([114.9.22.30]) [114.9.22.30]:34762: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 24 05:00:16 host2 sshd[1600502]: Disconnected from invalid user kapsch 152.42.165.179 port 44168 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.137
country_id: 1861060
description:
Dec 24 05:02:06 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=118.194.236.137, lip=66.85.158.92, TLS, session=<6iyp86ZGFqN2wuyJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-12-24 05:02:07 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:46874: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-24 05:02:30 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:58292: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 24 05:02:32 host2 sshd[1602605]: Disconnected from invalid user db-user 51.195.138.37 port 58994 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.137
country_id: 1861060
description:
Dec 24 05:02:35 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=118.194.236.137, lip=66.85.158.92, TLS, session=<gqxk9aZGruh2wuyJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Dec 24 05:02:42 host2 sshd[1602733]: Disconnected from invalid user ammar 212.11.64.162 port 52748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 24 05:03:47 host2 sshd[1604015]: Disconnected from invalid user agotoz 52.237.80.79 port 55180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Dec 24 05:04:26 host2 sshd[1604763]: Disconnected from invalid user deploy 107.174.55.72 port 35118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 24 05:04:58 host2 sshd[1605541]: Disconnected from invalid user userftp 152.42.165.179 port 34172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Dec 24 05:05:05 host2 sshd[1605842]: Disconnected from invalid user test1 107.174.55.72 port 35156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.81.246
country_id: 1835841
description:
Dec 24 05:04:36 host2 sshd[1604941]: Disconnected from invalid user kapsch 43.133.81.246 port 41586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 24 05:04:57 host2 sshd[1605536]: Disconnected from invalid user dnsadmin 51.195.138.37 port 39776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 24 05:05:28 host2 sshd[1606359]: Disconnected from invalid user git 51.195.138.37 port 59330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 24 05:05:34 host2 sshd[1606445]: Disconnected from invalid user supermaint 152.42.165.179 port 49950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Dec 24 05:05:45 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</CO0AKdGf8HG6xil>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 24 05:07:26 host2 sshd[1608049]: Received disconnect from 198.1.117.220 port 41752:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.165.179
country_id: 1880251
description:
Dec 24 05:06:48 host2 sshd[1607593]: Disconnected from invalid user git 152.42.165.179 port 39712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 24 05:06:55 host2 sshd[1607677]: Disconnected from invalid user agotoz 198.1.117.220 port 57714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Dec 24 05:07:42 host2 sshd[1608288]: Disconnected from invalid user uftp 107.174.55.72 port 42962 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.92
country_id: 6252001
description:
Dec 24 05:08:33 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.92, lip=66.85.158.92, session=<z2C0CqdGGuLG6xhc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.137
country_id: 1861060
description:
Dec 24 05:09:05 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=118.194.236.137, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<MyadDKdGHpJ2wuyJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.55.72
country_id: 6252001
description:
Dec 24 05:09:20 host2 sshd[1609832]: Disconnected from invalid user testuser2 107.174.55.72 port 51828 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.137
country_id: 1861060
description:
Dec 24 05:09:34 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=118.194.236.137, lip=66.85.158.91, TLS, session=<lPZWDqdG9tt2wuyJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.96.37.163
country_id: 2017370
description:
[2025-12-24 05:10:56 +0530] info [webmaild] 185.96.37.163 - info@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 24 05:11:59 host2 sshd[1612025]: Disconnected from invalid user test2 52.237.80.79 port 60162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Dec 24 05:14:54 host2 sshd[1614459]: Disconnected from invalid user pablo 212.11.64.162 port 52602 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 05:17:33 host2 pure-ftpd[1617506]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Dec 24 05:18:35 host2 sshd[1618584]: Disconnected from invalid user pablo 52.237.80.79 port 50764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Dec 24 05:20:01 host2 sshd[1620042]: Disconnected from invalid user user 212.11.64.162 port 36820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 24 05:21:18 host2 sshd[1621269]: Disconnected from invalid user es 101.36.109.176 port 44606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Dec 24 05:22:32 host2 sshd[1622039]: Disconnected from invalid user test2 212.11.64.162 port 50900 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 24 05:22:56 host2 sshd[1622295]: Disconnected from invalid user mary 101.36.109.176 port 48696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 24 05:23:59 host2 sshd[1623070]: Disconnected from invalid user mcadmin 101.36.109.176 port 43266 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 24 05:25:19 host2 sshd[1624125]: Received disconnect from 96.78.175.36 port 44704:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.104.157
country_id: 6252001
description:
Dec 24 05:24:43 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.104.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zY6LRKdGpuesymid>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 24 05:25:47 host2 sshd[1624424]: Disconnected from invalid user scs 96.78.175.36 port 60566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-24 05:26:08 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:45320: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-24 05:26:21 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:50092: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-12-24 05:26:53 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:44027: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.12.22.146
country_id: 6252001
description:
Dec 24 05:28:12 host2 pure-ftpd[1627195]: (?@154.12.22.146) [INFO] New connection from 154.12.22.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 05:28:31 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55733: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2025-12-24 05:29:11 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:35048: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-24 05:29:33 dovecot_login authenticator failed for H=(cm-178.232.80.9.get.no) [178.232.80.9]:50444: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-24 05:31:10 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:52716: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-24 05:34:38 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:43976: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-24 05:35:12 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:58500: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.81.231
country_id: 2921044
description:
Dec 24 05:38:22 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=138.68.81.231, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<FbtWdadGszmKRFHn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.55.191.16
country_id: 3469034
description:
Dec 24 05:38:26 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=201.55.191.16, lip=66.85.158.91, TLS, session=<XzBudKdGpuvJN78Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.43
country_id: 690791
description:
Dec 24 05:38:44 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.1.43, lip=66.85.158.91, TLS, session=<eiStdadGYpewZwEr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.206.154
country_id: 2921044
description:
Dec 24 05:38:58 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.206.154, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tLiAd6dGagguZc6a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.81.231
country_id: 2921044
description:
Dec 24 05:38:29 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 6 secs): user=<>, rip=138.68.81.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<gUfBdadGM0qKRFHn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.88.100.180
country_id: 2017370
description:
[2025-12-24 05:42:23 +0530] info [webmaild] 185.88.100.180 - info@weeratrading.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.177.141
country_id: 1522867
description:
2025-12-24 05:43:24 dovecot_login authenticator failed for H=2.132.177.141.dynamic.telecom.kz ([127.0.0.1]) [2.132.177.141]:48019: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.54.153.56
country_id: 1880251
description:
2025-12-24 05:43:42 dovecot_login authenticator failed for H=([127.0.0.1]) [103.54.153.56]:55420: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.185.26.213
country_id: 953987
description:
Dec 24 05:48:08 host2 sshd[1648279]: Disconnected from invalid user superuser 41.185.26.213 port 49626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.74
country_id: 1733045
description:
2025-12-24 05:49:28 dovecot_login authenticator failed for H=([49.125.201.74]) [49.125.201.74]:58070: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-24 05:49:39 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:59441: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.252
country_id: 1880251
description:
Dec 24 05:52:19 host2 sshd[1652206]: Disconnected from invalid user bitwarden 101.47.143.252 port 57274 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.177.87
country_id: 6252001
description:
Dec 24 05:51:52 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.249.177.87, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LN+bpadGco5K+bFX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-24 06:03:15 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:44350: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-24 06:03:54 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:43510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-24 06:04:24 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:59942: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.252
country_id: 1880251
description:
Dec 24 06:04:36 host2 sshd[1662944]: Disconnected from invalid user testuser 101.47.143.252 port 60566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-12-24 06:04:47 dovecot_login authenticator failed for H=([94.20.234.161]) [94.20.234.161]:41753: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.253.16.118
country_id: 6252001
description:
[2025-12-24 06:10:40 +0530] info [webmaild] 167.253.16.118 - info@kiriaswanu.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.57
country_id: 1643084
description:
[2025-12-24 06:13:30 +0530] info [cpaneld] 185.213.83.57 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.94.206
country_id: 2921044
description:
Dec 24 06:18:28 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.226.94.206, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<Z+C6BKhGGRZA4l7O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.91.215
country_id: 2921044
description:
Dec 24 06:19:03 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=64.226.91.215, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lQLeBqhGxsJA4lvX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.94.206
country_id: 2921044
description:
Dec 24 06:18:34 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 6 secs): user=<>, rip=64.226.94.206, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<GJ4fBahG1QVA4l7O>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 06:19:57 host2 pure-ftpd[1678239]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-24 06:20:34 dovecot_login authenticator failed for H=([209.202.195.148]) [209.202.195.148]:42854: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-24 06:20:48 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:44660: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.88
country_id: 6252001
description:
Dec 24 06:24:23 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.88, lip=66.85.158.92, session=<A/DtGahGCowUQGlY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 24 06:33:59 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<cf5CPKhGno/PWvQO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.88.71.156
country_id: 1819730
description:
Dec 24 06:34:31 host2 pure-ftpd[1692313]: (?@149.88.71.156) [INFO] New connection from 149.88.71.156


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.104
country_id: 6252001
description:
Dec 24 06:34:36 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=20.65.193.104, lip=66.85.158.91, session=<Ceh4PqhG6p4UQcFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.9
country_id: 6252001
description:
Dec 24 06:43:37 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.9, lip=66.85.158.92, session=<Hs65XqhG7tAUQGgJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.158.170.213
country_id: 2139685
description:
2025-12-24 06:54:00 dovecot_login authenticator failed for H=host-175-158-170-213.static.lagoon.nc ([127.0.0.1]) [175.158.170.213]:47700: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 06:55:15 host2 sshd[1709924]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.48.99.20
country_id: 6252001
description:
2025-12-24 06:54:37 dovecot_login authenticator failed for H=([127.0.0.1]) [74.48.99.20]:40460: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.149.79.127
country_id: 6252001
description:
2025-12-24 06:57:17 dovecot_login authenticator failed for H=([127.0.0.1]) [24.149.79.127]:55296: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2025-12-24 06:57:24 dovecot_login authenticator failed for H=([127.0.0.1]) [62.97.173.57]:54052: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.172.78
country_id: 6252001
description:
Dec 24 06:58:20 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.172.78, lip=66.85.158.91, session=<k0VXk6hGKLUofKxO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.251.170
country_id: 3865483
description:
Dec 24 07:08:07 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=179.0.251.170, lip=66.85.158.91, session=<6ShWtqhGot6zAPuq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.85.160
country_id: 3469034
description:
Dec 24 07:08:28 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=200.237.85.160, lip=66.85.158.91, TLS, session=<P4J3tqhG7g7I7VWg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-24 07:08:39 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48794: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.172
country_id: 3865483
description:
Dec 24 07:08:53 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt>, method=PLAIN, rip=179.0.249.172, lip=66.85.158.91, TLS, session=<3dHBt6hGWI+zAPms>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-24 07:09:08 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:45121: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-24 07:15:29 dovecot_login authenticator failed for H=([182.95.176.194]) [182.95.176.194]:58342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-24 07:15:58 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:34296: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.132
country_id: 3469034
description:
Dec 24 07:18:09 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=191.240.36.132, lip=66.85.158.91, TLS, session=<2zoc2ahGPoG/8CSE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.4.48
country_id: 2300660
description:
Dec 24 07:18:29 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.4.48, lip=66.85.158.91, TLS, session=<qkVQ2qhG4LApiwQw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 24 07:20:04 host2 sshd[1729476]: Disconnected from invalid user admin 152.32.129.140 port 10454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.222.206
country_id: 192950
description:
Dec 24 07:20:24 host2 sshd[1729897]: Invalid user secondcoffeeinternational from 41.203.222.206 port 10893


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 24 07:20:42 host2 sshd[1730130]: Disconnected from invalid user ftpuser 152.32.129.140 port 24306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Dec 24 07:21:21 host2 sshd[1730825]: Disconnected from invalid user admin 152.32.129.140 port 38152 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 07:22:29 host2 pure-ftpd[1732031]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.143.137
country_id: 690791
description:
Dec 24 07:22:47 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=37.221.143.137, lip=66.85.158.91, TLS, session=<gxq76ahG4rsl3Y+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.112
country_id: 3175395
description:
Dec 24 07:23:04 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=185.197.8.112, lip=66.85.158.91, TLS, session=</mPR6qhGfbO5xQhw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.139.191.44
country_id: 130758
description:
Dec 24 07:24:10 host2 sshd[1733852]: Disconnected from invalid user ntadmin 94.139.191.44 port 50548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.139.191.44
country_id: 130758
description:
Dec 24 07:25:17 host2 sshd[1735357]: Disconnected from invalid user vnc 94.139.191.44 port 50606 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.141
country_id: 6252001
description:
Dec 24 07:27:14 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.141, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<MdS0+qhG7dWTuYSN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-24 07:31:26 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:49159: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-24 07:32:05 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:43292: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-24 07:32:47 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:49962: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-24 07:32:30 dovecot_login authenticator failed for H=(static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:46260: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-24 07:33:42 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:52510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-24 07:33:48 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:41776: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-24 07:33:55 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:60659: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.14
country_id: 6252001
description:
Dec 24 07:33:58 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.14, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QybAEqlGKs2i2JYO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-24 07:33:30 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:56776: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.14
country_id: 6252001
description:
Dec 24 07:35:07 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=162.216.150.14, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<TT/nFqlGtPGi2JYO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 24 07:39:39 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.210.171, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<DvwRJ6lGXNcjy9Kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 24 07:40:39 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.171, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<fVqqKqlGuuQjy9Kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.14
country_id: 6252001
description:
Dec 24 07:41:17 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.14, lip=66.85.158.92, TLS, session=<jpHzLKlGuPGi2JYO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.16
country_id: 798549
description:
Dec 24 07:41:36 host2 pure-ftpd[1754090]: (?@85.217.140.16) [INFO] New connection from 85.217.140.16


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.140.16
country_id: 798549
description:
Dec 24 07:41:44 host2 pure-ftpd[1754218]: (?@85.217.140.16) [INFO] New connection from 85.217.140.16


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.158.147
country_id: 99237
description:
Dec 24 07:46:20 host2 sshd[1759639]: Disconnected from invalid user webadmin 138.124.158.147 port 41318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Dec 24 07:46:55 host2 sshd[1760106]: Disconnected from invalid user operador 138.124.158.147 port 47222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 24 07:47:09 host2 sshd[1760331]: Disconnected from invalid user rico 92.207.4.157 port 49258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.158.147
country_id: 99237
description:
Dec 24 07:47:28 host2 sshd[1760632]: Disconnected from invalid user admin 138.124.158.147 port 52358 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 24 07:48:25 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.171, lip=66.85.158.91, TLS, session=<hRZqRqlGCP4jy9Kr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 24 07:48:41 host2 sshd[1761727]: Disconnected from invalid user newuser 92.207.4.157 port 52728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 24 07:50:24 host2 sshd[1763766]: Disconnected from invalid user tianhao 92.207.4.157 port 37408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 24 07:53:40 host2 sshd[1767015]: Disconnected from invalid user deploy 198.12.75.220 port 48744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 24 07:55:32 host2 sshd[1769494]: Disconnected from invalid user min 198.12.75.220 port 34822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 24 07:56:09 host2 sshd[1770027]: Disconnected from invalid user alice 198.12.75.220 port 48070 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.183.254.35
country_id: 2017370
description:
[2025-12-24 08:02:32 +0530] info [webmaild] 5.183.254.35 - info@vtradelanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec 24 08:03:33 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<eT+WfKlGruFChJl3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.74.208.138
country_id: 6252001
description:
Dec 24 08:06:01 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.74.208.138, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nZZchalGbJgoStCK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-24 08:06:37 dovecot_login authenticator failed for H=66.68.243.35.bc.googleusercontent.com [35.243.68.66]:53660: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-24 08:06:42 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:43588: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-24 08:06:59 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:41488: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.168
country_id: 2635167
description:
Dec 24 08:08:46 host2 pure-ftpd[1781817]: (?@185.247.137.168) [INFO] New connection from 185.247.137.168


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 08:11:49 host2 sshd[1784822]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.54
country_id: 1643084
description:
Dec 24 08:12:46 host2 sshd[1785803]: Invalid user cloudtourssrilan_travel from 182.8.225.54 port 30962


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.54
country_id: 1643084
description:
[2025-12-24 08:12:48 +0530] info [whostmgrd] 182.8.225.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.217
country_id: 6252001
description:
Dec 24 08:17:00 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.202.117.217, lip=66.85.158.91, TLS, session=<nbCnrKlGEMusynXZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.148
country_id: 3469034
description:
Dec 24 08:17:53 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=191.240.37.148, lip=66.85.158.91, TLS, session=<GL+vrqlGa8W/8CWU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-24 08:18:01 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:35467: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.199
country_id: 3865483
description:
Dec 24 08:18:14 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.190.167.199, lip=66.85.158.91, TLS, session=<6tzyr6lGmaq6vqfH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-24 08:18:59 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:60619: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-24 08:19:33 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:40262: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-24 08:19:14 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:39095: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 08:22:37 host2 sshd[1795537]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.97.131
country_id: 6290252
description:
Dec 24 08:22:11 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=109.206.97.131, lip=66.85.158.91, TLS, session=<5IE8vqlGjrxtzmGD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.208
country_id: 3175395
description:
Dec 24 08:22:29 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=171.22.233.208, lip=66.85.158.91, TLS, session=<qvxJv6lGqserFunQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 08:25:00 host2 pure-ftpd[1797696]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-24 08:26:15 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:51570: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-24 08:26:43 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:42469: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Dec 24 08:30:59 host2 sshd[1803538]: Disconnected from invalid user ubuntu 41.216.177.55 port 45590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.143.34
country_id: 1819730
description:
Dec 24 08:30:39 host2 sshd[1803316]: Disconnected from invalid user emily 124.156.143.34 port 50704 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.156.143.34
country_id: 1819730
description:
Dec 24 08:31:19 host2 sshd[1803826]: Disconnected from invalid user dev 124.156.143.34 port 35510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Dec 24 08:32:33 host2 sshd[1804738]: Disconnected from invalid user mbp 118.26.36.241 port 46280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 24 08:32:34 host2 sshd[1804753]: Disconnected from invalid user emily 79.168.139.28 port 48314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Dec 24 08:33:10 host2 sshd[1805267]: Disconnected from invalid user uno 118.26.36.241 port 44656 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 24 08:33:38 host2 sshd[1805658]: Disconnected from invalid user ansible 79.168.139.28 port 46164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.143.34
country_id: 1819730
description:
Dec 24 08:34:31 host2 sshd[1806439]: Disconnected from invalid user jin 124.156.143.34 port 44250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 24 08:36:10 host2 sshd[1808557]: Disconnected from invalid user zhy 79.168.139.28 port 59026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.177.55
country_id: 1643084
description:
Dec 24 08:36:43 host2 sshd[1809170]: Disconnected from invalid user liuyong 41.216.177.55 port 41366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-24 08:38:13 dovecot_login authenticator failed for H=([45.194.26.149]) [45.194.26.149]:43137: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 08:40:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55151: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-12-24 08:41:10 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:59986: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.184.94.75
country_id: 2328926
description:
2025-12-24 08:41:40 dovecot_login authenticator failed for H=41-184-94-75.rv.ipnxtelecoms.com ([102.164.35.116]) [41.184.94.75]:57890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.170.21.223
country_id: 6252001
description:
2025-12-24 08:41:54 dovecot_login authenticator failed for H=(75-170-21-223.rcmt.centurylink.net) [75.170.21.223]:45240: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
country_id: 3469034
description:
2025-12-24 08:42:21 dovecot_login authenticator failed for H=(177-174-89-105.user.vivozap.com.br) [177.174.89.99]:46367: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-24 08:42:36 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:59628: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 24 08:49:10 host2 dovecot[1133416]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS, session=<8PmsH6pGUODPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 24 08:49:10 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<WWezH6pGVODPWvQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.232.62.166
country_id: 3469034
description:
Dec 24 08:58:00 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=168.232.62.166, lip=66.85.158.91, TLS, session=<6RY4PqpGCbCo6D6m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-24 08:58:15 dovecot_login authenticator failed for H=([178.150.135.19]) [178.150.135.19]:36890: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.0.248.88
country_id: 3469034
description:
Dec 24 08:58:19 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=131.0.248.88, lip=66.85.158.91, TLS, session=<vu9mP6pGvrCDAPhY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-24 08:58:58 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:58174: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 24 09:01:41 host2 sshd[1841807]: Disconnected from invalid user thomas 45.230.150.7 port 43404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-12-24 09:02:46 dovecot_login authenticator failed for H=([203.172.213.166]) [203.172.213.166]:42824: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-24 09:02:59 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:51640: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Dec 24 09:04:44 host2 sshd[1845166]: Disconnected from invalid user joaquin 95.39.201.205 port 56940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 24 09:05:50 host2 sshd[1846619]: Disconnected from invalid user postgres 38.19.156.18 port 53170 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 24 09:06:23 host2 sshd[1847352]: Disconnected from invalid user username 45.230.150.7 port 34886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec 24 09:07:35 host2 sshd[1848620]: Disconnected from invalid user dev 45.230.150.7 port 59176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 24 09:07:40 host2 sshd[1848704]: Disconnected from invalid user wordpress 38.19.156.18 port 60840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Dec 24 09:07:55 host2 sshd[1848983]: Disconnected from invalid user username 104.168.35.231 port 53186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 24 09:08:56 host2 sshd[1849861]: Disconnected from invalid user minecraft 38.19.156.18 port 56542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Dec 24 09:09:31 host2 sshd[1850408]: Disconnected from invalid user thomas 104.168.35.231 port 55948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 24 09:10:08 host2 sshd[1851067]: Disconnected from invalid user oracle 38.19.156.18 port 52230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Dec 24 09:09:10 host2 sshd[1850098]: Disconnected from invalid user nikita 95.39.201.205 port 53598 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.49.64
country_id: 6252001
description:
[2025-12-24 09:10:22 +0530] info [cpaneld] 45.3.49.64 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.225.97.41
country_id: 2921044
description:
Dec 24 09:11:07 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.225.97.41, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<XJYwbqpGiVdA4WEp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Dec 24 09:12:08 host2 sshd[1852911]: Disconnected from invalid user postgres 104.168.35.231 port 60968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.225.97.41
country_id: 2921044
description:
Dec 24 09:11:14 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 6 secs): user=<>, rip=64.225.97.41, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<owGabqpG72lA4WEp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.121.160
country_id: 2921044
description:
Dec 24 09:11:51 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.121.160, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4k3ZcKpG7o+d5nmg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.96
country_id: 2264397
description:
Dec 24 09:13:13 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.156.128.96, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<TjG7dapG1MMtnIBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.97
country_id: 2264397
description:
Dec 24 09:13:15 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.128.97, lip=66.85.158.92, TLS, session=<VQHVdapG4YgtnIBh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.98
country_id: 2264397
description:
Dec 24 09:13:17 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.98, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ghvsdapGd9otnIBi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.99
country_id: 2264397
description:
Dec 24 09:13:21 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.128.99, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<f0UqdqpGP8stnIBj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.35.231
country_id: 6252001
description:
Dec 24 09:13:40 host2 sshd[1854605]: Disconnected from invalid user deploy 104.168.35.231 port 59804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Dec 24 09:14:38 host2 sshd[1855530]: Disconnected from invalid user work 95.39.201.205 port 42508 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.169.247
country_id: 6252001
description:
[2025-12-24 09:14:49 +0530] info [webmaild] 140.235.169.247 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-24 09:18:13 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:48190: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 24 09:22:19 host2 sshd[1862671]: Disconnected from invalid user confluence 107.175.159.248 port 48752 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.183.27
country_id: 6252001
description:
Dec 24 09:23:46 host2 pure-ftpd[1864241]: (?@152.32.183.27) [INFO] New connection from 152.32.183.27


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 24 09:24:11 host2 sshd[1864620]: Disconnected from invalid user user2 107.175.159.248 port 48810 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 09:27:31 host2 pure-ftpd[1868750]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.159
country_id: 6252001
description:
Dec 24 09:28:40 host2 pure-ftpd[1869943]: (?@20.65.193.159) [INFO] New connection from 20.65.193.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2025-12-24 09:30:14 dovecot_login authenticator failed for H=([49.124.151.14]) [49.124.151.14]:45610: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-24 09:30:57 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:39416: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Dec 24 09:33:08 host2 sshd[1874876]: Disconnected from invalid user gmodserver 107.175.159.248 port 49118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-24 09:32:26 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:39178: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.22.91.68
country_id: 3175395
description:
[2025-12-24 09:33:35 +0530] info [cpaneld] 149.22.91.68 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.17.41.25
country_id: 6252001
description:
[2025-12-24 09:33:52 +0530] info [webmaild] 84.17.41.25 - marketing@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.54
country_id: 2264397
description:
Dec 24 09:37:06 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=109.105.210.54, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<r1Ijy6pGI+NtadI2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.55
country_id: 2264397
description:
Dec 24 09:37:11 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.210.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=</WFqy6pGne1tadI3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.210.55
country_id: 2264397
description:
Dec 24 09:36:58 host2 dovecot[1133416]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.55, lip=66.85.158.91, TLS, session=<vyWqyqpGl9ptadI3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.52
country_id: 2264397
description:
Dec 24 09:37:02 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.52, lip=66.85.158.91, TLS, session=<YQHfyqpGRNBtadI0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.53
country_id: 2264397
description:
Dec 24 09:37:04 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.210.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<LjYFy6pGA8htadI1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.51
country_id: 1269750
description:
Dec 24 09:38:54 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=43.229.225.51, lip=66.85.158.91, TLS, session=<lYZw0KpGcL4r5eEz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.36.202.204
country_id: 3469034
description:
Dec 24 09:39:04 host2 dovecot[1133416]: imap-login: Disconnected: Shutting down (auth process communication failure): user=<gihan>, method=LOGIN, rip=138.36.202.204, lip=66.85.158.91, session=<szGr0apG2uKKJMrM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.159.20.88
country_id: 6252001
description:
[2025-12-24 09:41:27 +0530] info [webmaild] 45.159.20.88 - info@colourmarklabels.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2025-12-24 09:43:29 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.214.212]:53912: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-12-24 09:45:02 dovecot_login authenticator failed for H=(190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:34476: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.219.9
country_id: 3865483
description:
Dec 24 09:46:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=186.1.219.9, lip=66.85.158.91, TLS, session=<32sG7KpG4rm6AdsJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.87.46
country_id: 3469034
description:
Dec 24 09:46:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=201.159.87.46, lip=66.85.158.91, TLS, session=<Uu497apGGZzJn1cu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.210.106
country_id: 1819730
description:
Dec 24 09:50:05 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=123.58.210.106, lip=66.85.158.91, session=<1bSH+apGqJJ7OtJq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.210.106
country_id: 1819730
description:
Dec 24 09:50:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=123.58.210.106, lip=66.85.158.91, session=<5jCi+qpGtJJ7OtJq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.130.79
country_id: 2077456
description:
2025-12-24 09:50:56 dovecot_login authenticator failed for H=(61-69-130-79.static.tpgi.com.au) [61.69.130.79]:54594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-24 09:51:27 dovecot_login authenticator failed for H=([189.109.48.81]) [189.56.202.86]:41432: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.210.106
country_id: 1819730
description:
Dec 24 09:52:13 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=123.58.210.106, lip=66.85.158.92, session=<d+AvAatGkot7OtJq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 09:55:54 host2 sshd[1903843]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-12-24 09:57:17 dovecot_login authenticator failed for H=5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:38562: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-24 09:57:25 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:47981: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-24 09:57:40 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:43384: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.11.179.18
country_id: 953987
description:
2025-12-24 09:58:37 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [196.11.179.18]:52557: 535 Incorrect authentication data (set_id=charana.wijesiri@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.75
country_id: 2328926
description:
Dec 24 10:00:20 host2 pure-ftpd[1907694]: (?@102.204.223.75) [INFO] New connection from 102.204.223.75


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-24 10:03:20 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:56748: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 10:06:42 host2 sshd[1914205]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-24 10:09:53 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:54490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-24 10:10:26 dovecot_login authenticator failed for H=([65.20.136.183]) [65.20.136.183]:38679: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.76.96
country_id: 6252001
description:
[2025-12-24 10:12:48 +0530] info [cpaneld] 99.66.76.96 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.113.231
country_id: 6252001
description:
[2025-12-24 10:12:49 +0530] info [cpaneld] 73.15.113.231 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.167.141
country_id: 6252001
description:
[2025-12-24 10:12:50 +0530] info [cpaneld] 23.242.167.141 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.127.149.81
country_id: 6252001
description:
[2025-12-24 10:12:51 +0530] info [whostmgrd] 76.127.149.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.159.130.57
country_id: 6252001
description:
[2025-12-24 10:12:52 +0530] info [cpaneld] 47.159.130.57 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.189.59.120
country_id: 6252001
description:
[2025-12-24 10:12:53 +0530] info [cpaneld] 67.189.59.120 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.83.188.112
country_id: 6252001
description:
[2025-12-24 10:12:55 +0530] info [cpaneld] 72.83.188.112 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.250.151
country_id: 6252001
description:
Dec 24 10:13:50 host2 pure-ftpd[1922400]: (?@172.174.250.151) [INFO] New connection from 172.174.250.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.81.211.199
country_id: 6252001
description:
[2025-12-24 10:14:42 +0530] info [cpaneld] 75.81.211.199 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.22.171.207
country_id: 6252001
description:
[2025-12-24 10:14:45 +0530] info [cpaneld] 76.22.171.207 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.225.124
country_id: 6252001
description:
[2025-12-24 10:14:43 +0530] info [cpaneld] 35.149.225.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.174.33.20
country_id: 6252001
description:
[2025-12-24 10:14:46 +0530] info [whostmgrd] 104.174.33.20 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.94.76.158
country_id: 6252001
description:
[2025-12-24 10:14:48 +0530] info [cpaneld] 70.94.76.158 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.41.212.234
country_id: 6252001
description:
[2025-12-24 10:14:50 +0530] info [cpaneld] 66.41.212.234 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.212.154.47
country_id: 6252001
description:
[2025-12-24 10:14:52 +0530] info [cpaneld] 71.212.154.47 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-24 10:16:06 dovecot_login authenticator failed for H=(pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:56294: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.129.128.154
country_id: 6252001
description:
[2025-12-24 10:16:52 +0530] info [whostmgrd] 75.129.128.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.135.78.101
country_id: 6252001
description:
[2025-12-24 10:16:54 +0530] info [cpaneld] 135.135.78.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.179.177.156
country_id: 6252001
description:
[2025-12-24 10:16:55 +0530] info [cpaneld] 71.179.177.156 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.175.130.53
country_id: 6252001
description:
[2025-12-24 10:16:58 +0530] info [cpaneld] 70.175.130.53 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.251.71.225
country_id: 6252001
description:
[2025-12-24 10:16:47 +0530] info [cpaneld] 75.251.71.225 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.61.44.84
country_id: 6252001
description:
[2025-12-24 10:16:49 +0530] info [cpaneld] 66.61.44.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-12-24 10:16:24 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:34408: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.111.244.2
country_id: 6252001
description:
[2025-12-24 10:16:50 +0530] info [cpaneld] 71.111.244.2 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


