# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.255.92.255
country_id: 6252001
description:
[2025-12-30 21:01:00 +0530] info [cpaneld] 68.255.92.255 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.140.11
country_id: 6252001
description:
[2025-12-30 21:01:02 +0530] info [cpaneld] 108.66.140.11 - monarchdss "GET /login/?login_only=1&user=monarchdss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.34.10.131
country_id: 6252001
description:
[2025-12-30 21:01:08 +0530] info [cpaneld] 100.34.10.131 - monar "GET /login/?login_only=1&user=monar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.204.240.105
country_id: 6252001
description:
[2025-12-30 21:01:14 +0530] info [cpaneld] 162.204.240.105 - monarch2 "GET /login/?login_only=1&user=monarch2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.181.57.46
country_id: 6252001
description:
[2025-12-30 21:01:13 +0530] info [cpaneld] 73.181.57.46 - monarch1 "GET /login/?login_only=1&user=monarch1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.141.48
country_id: 6252001
description:
[2025-12-30 21:01:07 +0530] info [cpaneld] 184.179.141.48 - monarc "GET /login/?login_only=1&user=monarc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.182.214.174
country_id: 6252001
description:
[2025-12-30 21:01:09 +0530] info [cpaneld] 97.182.214.174 - mona "GET /login/?login_only=1&user=mona&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mona (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.165.13
country_id: 6252001
description:
[2025-12-30 21:01:12 +0530] info [cpaneld] 98.97.165.13 - mo "GET /login/?login_only=1&user=mo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.174.209.184
country_id: 6252001
description:
[2025-12-30 21:01:04 +0530] info [cpaneld] 140.174.209.184 - monarchdsscom "GET /login/?login_only=1&user=monarchdsscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarchdsscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.79.241.91
country_id: 6252001
description:
[2025-12-30 21:01:06 +0530] info [cpaneld] 108.79.241.91 - monarch "GET /login/?login_only=1&user=monarch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarch (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.138.49
country_id: 6252001
description:
[2025-12-30 21:01:05 +0530] info [cpaneld] 140.228.138.49 - monarchd "GET /login/?login_only=1&user=monarchd&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user monarchd (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 21:06:04 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<PH73HS1HONSYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Dec 30 21:07:49 host2 sshd[2114920]: Disconnected from invalid user chaitanya 45.78.201.248 port 42320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 21:09:02 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<HlOfKC1HfpWnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.150.217.20
country_id: 3017382
description:
Dec 30 21:08:20 host2 sshd[2115388]: Disconnected from invalid user wanghao 83.150.217.20 port 42186 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 21:08:58 host2 pure-ftpd[2115924]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 21:09:40 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0aDiKi1HuLAv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2025-12-30 21:09:52 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:33512: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.180.151
country_id: 2802361
description:
Dec 30 21:09:55 host2 pure-ftpd[2117150]: (?@35.195.180.151) [INFO] New connection from 35.195.180.151


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 30 21:09:17 host2 sshd[2116268]: Disconnected from invalid user ai 38.137.11.10 port 10952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 21:10:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<cytVLS1HYrMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 21:10:30 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ZrPZLS1HdKCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.226
country_id: 798544
description:
Dec 30 21:10:57 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.231.121.226, lip=66.85.158.91, TLS, session=<gX2VLi1Ht6Zb53ni>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 21:10:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<hy9ALS1HlJGeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-30 21:10:23 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:44987: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.237
country_id: 3469034
description:
Dec 30 21:10:29 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.120.73.237, lip=66.85.158.91, TLS, session=<cgzaLC1HnKm7eEnt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 21:11:23 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<V7sEMS1Hpt8v/AU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:14:06 host2 sshd[2121600]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.230.102.130
country_id: 3996063
description:
Dec 30 21:13:27 host2 sshd[2120991]: Disconnected from invalid user flash 187.230.102.130 port 36362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:13:45 host2 sshd[2121429]: Disconnected from invalid user ubuntu 168.197.99.226 port 60894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 21:14:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7J2yOi1HTwtniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:14:21 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<2BG7Oy1HG8+i2JYl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.150.217.20
country_id: 3017382
description:
Dec 30 21:14:38 host2 sshd[2122314]: Disconnected from invalid user frappe 83.150.217.20 port 47362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 21:14:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<rn3QPC1HTLgzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:14:55 host2 sshd[2122690]: Disconnected from invalid user ai 168.197.99.226 port 52372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.28.8
country_id: 3017382
description:
Dec 30 21:15:12 host2 sshd[2123144]: Disconnected from invalid user bbs 51.178.28.8 port 38372 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:15:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<lHH+Pi1HYu6i2JYl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.197.99.226
country_id: 3624060
description:
Dec 30 21:15:29 host2 sshd[2123462]: Disconnected from invalid user ts 168.197.99.226 port 43152 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.119.29.137
country_id: 6252001
description:
Dec 30 21:16:14 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=40.119.29.137, lip=66.85.158.91, TLS, session=<oAZwQi1Hrooodx2J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.28.8
country_id: 3017382
description:
Dec 30 21:16:15 host2 sshd[2124294]: Disconnected from invalid user vpn 51.178.28.8 port 44266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 30 21:17:37 host2 sshd[2125962]: Disconnected from invalid user deploy 165.232.178.116 port 49434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 21:17:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<PDcGSC1HnoIyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-30 21:17:58 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:40138: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 30 21:17:59 host2 sshd[2126360]: Disconnected from invalid user ubuntu 38.137.11.10 port 36036 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.47.111
country_id: 6252001
description:
Dec 30 21:18:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.29.47.111, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<d+KmSy1HsKIUHS9v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-30 21:18:15 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:42801: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.232.178.116
country_id: 1269750
description:
Dec 30 21:18:17 host2 sshd[2126798]: Disconnected from invalid user cristian 165.232.178.116 port 45862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:19:54 host2 sshd[2128937]: Disconnected from invalid user soporte 189.217.130.86 port 36409 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 21:20:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<5zv4US1HlI9CdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.115.157.22
country_id: 6252001
description:
[2025-12-30 21:20:50 +0530] info [cpaneld] 99.115.157.22 - euroent "GET /login/?login_only=1&user=euroent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:20:17 host2 sshd[2129773]: Disconnected from invalid user akshay 159.198.32.61 port 49220 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.76.154.205
country_id: 6252001
description:
[2025-12-30 21:20:46 +0530] info [whostmgrd] 108.76.154.205 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.179.50.142
country_id: 6252001
description:
[2025-12-30 21:20:45 +0530] info [cpaneld] 71.179.50.142 - euroentertainmentlk "GET /login/?login_only=1&user=euroentertainmentlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.92.235.130
country_id: 6252001
description:
[2025-12-30 21:20:49 +0530] info [cpaneld] 168.92.235.130 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.26.30
country_id: 6252001
description:
[2025-12-30 21:20:56 +0530] info [cpaneld] 98.97.26.30 - euro "GET /login/?login_only=1&user=euro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euro (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 30 21:20:11 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS, session=<M+qVUC1HOvqi2JYl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.240.154
country_id: 6252001
description:
[2025-12-30 21:20:42 +0530] info [cpaneld] 140.186.240.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.251.185.32
country_id: 6252001
description:
[2025-12-30 21:20:43 +0530] info [cpaneld] 108.251.185.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.117.101.175
country_id: 6252001
description:
[2025-12-30 21:20:53 +0530] info [cpaneld] 75.117.101.175 - euroen "GET /login/?login_only=1&user=euroen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.138.96.170
country_id: 6252001
description:
[2025-12-30 21:20:58 +0530] info [cpaneld] 76.138.96.170 - eu "GET /login/?login_only=1&user=eu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.195.77.134
country_id: 6252001
description:
[2025-12-30 21:21:00 +0530] info [cpaneld] 206.195.77.134 - euroent2 "GET /login/?login_only=1&user=euroent2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.226.242
country_id: 6252001
description:
[2025-12-30 21:20:48 +0530] info [cpaneld] 172.59.226.242 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.238.51.162
country_id: 6252001
description:
[2025-12-30 21:20:54 +0530] info [cpaneld] 96.238.51.162 - euroe "GET /login/?login_only=1&user=euroe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.122.234.75
country_id: 6252001
description:
[2025-12-30 21:20:57 +0530] info [cpaneld] 76.122.234.75 - eur "GET /login/?login_only=1&user=eur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.235.5.116
country_id: 6252001
description:
[2025-12-30 21:20:59 +0530] info [cpaneld] 162.235.5.116 - euroent1 "GET /login/?login_only=1&user=euroent1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 21:21:12 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<sdYdVC1HjZx100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:21:22 host2 sshd[2130843]: Disconnected from invalid user automation 159.198.32.61 port 44204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:22:59 host2 sshd[2132072]: Disconnected from invalid user dev 57.128.237.234 port 48788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.32.61
country_id: 6252001
description:
Dec 30 21:23:31 host2 sshd[2132437]: Disconnected from invalid user soporte 159.198.32.61 port 34164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:23:36 host2 sshd[2132472]: Disconnected from invalid user user 194.233.74.228 port 42278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:23:43 host2 sshd[2132558]: Disconnected from invalid user pwserver 189.217.130.86 port 47512 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.143
country_id: 6252001
description:
Dec 30 21:24:04 host2 dovecot[1836975]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.188.143, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CBd7Xi1HcqEs3LyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 30 21:24:05 host2 sshd[2132821]: Disconnected from invalid user fy 51.89.166.236 port 55530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:24:19 host2 sshd[2132993]: Disconnected from invalid user ubuntu 189.217.130.86 port 26448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:24:57 host2 sshd[2133394]: Disconnected from invalid user ubuntu 189.217.130.86 port 16915 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 21:25:01 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<1cvEYS1HerSeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 30 21:26:09 host2 sshd[2134442]: Disconnected from invalid user minecraft 189.217.130.86 port 41965 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.137.92.76
country_id: 6252001
description:
[2025-12-30 21:26:24 +0530] info [whostmgrd] 107.137.92.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.173.110.145
country_id: 6252001
description:
[2025-12-30 21:26:33 +0530] info [cpaneld] 70.173.110.145 - aj "GET /login/?login_only=1&user=aj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.199.205.184
country_id: 6252001
description:
[2025-12-30 21:26:25 +0530] info [cpaneld] 71.199.205.184 - ajsstarlogcom "GET /login/?login_only=1&user=ajsstarlogcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarlogcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.234.145.171
country_id: 6252001
description:
[2025-12-30 21:26:27 +0530] info [cpaneld] 69.234.145.171 - ajsstar "GET /login/?login_only=1&user=ajsstar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.64.76.91
country_id: 6252001
description:
[2025-12-30 21:26:30 +0530] info [cpaneld] 108.64.76.91 - ajsst "GET /login/?login_only=1&user=ajsst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.242.122.25
country_id: 6252001
description:
[2025-12-30 21:26:33 +0530] info [cpaneld] 97.242.122.25 - ajs "GET /login/?login_only=1&user=ajs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajs (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.63.241.40
country_id: 6252001
description:
[2025-12-30 21:26:35 +0530] info [cpaneld] 96.63.241.40 - ajsstar2 "GET /login/?login_only=1&user=ajsstar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec 30 21:26:51 host2 sshd[2135116]: Disconnected from invalid user joao 45.144.233.139 port 46012 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.102.186.210
country_id: 6252001
description:
[2025-12-30 21:26:21 +0530] info [cpaneld] 199.102.186.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.224.188.153
country_id: 6252001
description:
[2025-12-30 21:26:22 +0530] info [cpaneld] 167.224.188.153 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.46.182.59
country_id: 6252001
description:
[2025-12-30 21:26:26 +0530] info [cpaneld] 75.46.182.59 - ajsstarl "GET /login/?login_only=1&user=ajsstarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.31.86.126
country_id: 6252001
description:
[2025-12-30 21:26:31 +0530] info [cpaneld] 75.31.86.126 - ajss "GET /login/?login_only=1&user=ajss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Dec 30 21:26:41 host2 sshd[2134987]: Disconnected from invalid user aman 45.169.128.70 port 55634 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.111.198.218
country_id: 6252001
description:
[2025-12-30 21:26:23 +0530] info [cpaneld] 98.111.198.218 - ajsstarlog "GET /login/?login_only=1&user=ajsstarlog&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.161.142.65
country_id: 6252001
description:
[2025-12-30 21:26:30 +0530] info [cpaneld] 98.161.142.65 - ajssta "GET /login/?login_only=1&user=ajssta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.222.14.68
country_id: 6252001
description:
[2025-12-30 21:26:34 +0530] info [cpaneld] 162.222.14.68 - ajsstar1 "GET /login/?login_only=1&user=ajsstar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Dec 30 21:27:25 host2 sshd[2135534]: Disconnected from invalid user git 45.169.128.70 port 42164 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:27:58 host2 sshd[2135884]: Received disconnect from 57.128.237.234 port 45684:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 30 21:27:13 host2 sshd[2135384]: Disconnected from invalid user ai 51.89.166.236 port 53144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec 30 21:27:20 host2 sshd[2135479]: Disconnected from invalid user fy 45.144.233.139 port 39046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:27:31 host2 sshd[2135614]: Disconnected from invalid user tina 57.128.237.234 port 56302 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.95
country_id: 6252001
description:
Dec 30 21:27:58 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.95, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Y+F0bC1HZ+lAPsVf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:29:00 host2 sshd[2136620]: Disconnected from invalid user ironman 194.233.74.228 port 48672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.92
country_id: 6252001
description:
Dec 30 21:28:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.92, lip=66.85.158.91, TLS handshaking: Connection closed, session=<O6qDbS1HqoBAPsVc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec 30 21:28:19 host2 sshd[2136171]: Disconnected from invalid user ubuntu 194.233.74.228 port 44614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.237.234
country_id: 798544
description:
Dec 30 21:28:26 host2 sshd[2136233]: Disconnected from invalid user ftptest 57.128.237.234 port 49302 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 30 21:29:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<AXgHcS1HQJLE+2YV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 21:30:31 host2 sshd[2137840]: Disconnected from invalid user user 2.57.121.25 port 14651 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 21:31:36 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rHVLeS1H0OWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 21:32:08 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<X8c0ey1HHoUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 21:33:04 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<vX2Rfi1H7HojupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:36:24 host2 sshd[2143790]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 21:39:00 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<YfjKky1Hep1nmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:39:39 host2 sshd[2146233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 21:39:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<u0UIly1HPJunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-30 21:40:12 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:58724: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 21:40:23 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Gfy8mC1HkLxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.199
country_id: 2186224
description:
2025-12-30 21:40:32 dovecot_login authenticator failed for H=([121.73.166.199]) [121.73.166.199]:56608: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.82.9.177
country_id: 6252001
description:
[2025-12-30 21:41:29 +0530] info [cpaneld] 192.82.9.177 - greenta1 "GET /login/?login_only=1&user=greenta1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.114.56.3
country_id: 6252001
description:
[2025-12-30 21:41:28 +0530] info [cpaneld] 71.114.56.3 - gr "GET /login/?login_only=1&user=gr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.209.92.59
country_id: 6252001
description:
[2025-12-30 21:41:13 +0530] info [cpaneld] 97.209.92.59 - greentaraceylon "GET /login/?login_only=1&user=greentaraceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.84.11.203
country_id: 6252001
description:
[2025-12-30 21:41:18 +0530] info [cpaneld] 135.84.11.203 - greenta "GET /login/?login_only=1&user=greenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.107.206
country_id: 6252001
description:
[2025-12-30 21:41:24 +0530] info [cpaneld] 172.56.107.206 - green "GET /login/?login_only=1&user=green&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user green (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.48.136.53
country_id: 6252001
description:
[2025-12-30 21:41:27 +0530] info [cpaneld] 173.48.136.53 - gre "GET /login/?login_only=1&user=gre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.22.235
country_id: 6252001
description:
[2025-12-30 21:41:15 +0530] info [whostmgrd] 73.241.22.235 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.167.116.23
country_id: 6252001
description:
[2025-12-30 21:41:26 +0530] info [cpaneld] 73.167.116.23 - gree "GET /login/?login_only=1&user=gree&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.2.149.7
country_id: 6252001
description:
[2025-12-30 21:41:11 +0530] info [cpaneld] 172.2.149.7 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.11.122.165
country_id: 6252001
description:
[2025-12-30 21:41:12 +0530] info [cpaneld] 73.11.122.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.107.199
country_id: 6252001
description:
[2025-12-30 21:41:16 +0530] info [cpaneld] 50.5.107.199 - greentaraceyloncom "GET /login/?login_only=1&user=greentaraceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.52.122.124
country_id: 6252001
description:
[2025-12-30 21:41:22 +0530] info [cpaneld] 184.52.122.124 - greent "GET /login/?login_only=1&user=greent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.45.106.159
country_id: 6252001
description:
[2025-12-30 21:41:17 +0530] info [cpaneld] 108.45.106.159 - greentar "GET /login/?login_only=1&user=greentar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.104.175.64
country_id: 6252001
description:
[2025-12-30 21:41:30 +0530] info [cpaneld] 99.104.175.64 - greenta2 "GET /login/?login_only=1&user=greenta2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 21:44:41 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<6FwUqC1HVs8FhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:45:57 host2 sshd[2151496]: Disconnected from invalid user cherry 187.120.37.209 port 25458 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 30 21:47:17 host2 sshd[2152336]: Disconnected from invalid user deluge 103.52.115.25 port 59460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 21:47:48 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VvA0sy1HynYjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:48:27 host2 sshd[2154069]: Disconnected from invalid user test1 187.33.59.116 port 35666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-30 21:48:46 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:50600: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2025-12-30 21:49:04 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:48314: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 21:49:38 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<CwzIuS1HdtQvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:49:16 host2 sshd[2154928]: Disconnected from invalid user artur 187.120.37.209 port 24821 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 21:49:33 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<A4aCuS1HzoCeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.120.37.209
country_id: 3469034
description:
Dec 30 21:50:36 host2 sshd[2168044]: Disconnected from invalid user de 187.120.37.209 port 24677 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:51:24 host2 sshd[2168635]: Disconnected from invalid user elasticsearch 187.33.59.116 port 58121 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.175.2
country_id: 6252001
description:
[2025-12-30 21:52:46 +0530] info [whostmgrd] 67.187.175.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.75.103.249
country_id: 6252001
description:
[2025-12-30 21:52:50 +0530] info [cpaneld] 38.75.103.249 - neotechl "GET /login/?login_only=1&user=neotechl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.204.248.136
country_id: 6252001
description:
[2025-12-30 21:52:59 +0530] info [cpaneld] 104.204.248.136 - ne "GET /login/?login_only=1&user=ne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.90.45.189
country_id: 6252001
description:
[2025-12-30 21:52:58 +0530] info [cpaneld] 75.90.45.189 - neo "GET /login/?login_only=1&user=neo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.238.230.8
country_id: 6252001
description:
[2025-12-30 21:52:43 +0530] info [cpaneld] 76.238.230.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.98.152
country_id: 6252001
description:
[2025-12-30 21:52:47 +0530] info [cpaneld] 24.4.98.152 - neotechlkcom "GET /login/?login_only=1&user=neotechlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.39.155.2
country_id: 6252001
description:
[2025-12-30 21:52:41 +0530] info [cpaneld] 75.39.155.2 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.47.173
country_id: 6252001
description:
[2025-12-30 21:52:54 +0530] info [cpaneld] 73.158.47.173 - neote "GET /login/?login_only=1&user=neote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.55.255.21
country_id: 6252001
description:
[2025-12-30 21:52:55 +0530] info [cpaneld] 75.55.255.21 - neot "GET /login/?login_only=1&user=neot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.144.1.14
country_id: 6252001
description:
[2025-12-30 21:52:44 +0530] info [cpaneld] 24.144.1.14 - neotechlk "GET /login/?login_only=1&user=neotechlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.141.79
country_id: 6252001
description:
[2025-12-30 21:52:51 +0530] info [cpaneld] 108.46.141.79 - neotech "GET /login/?login_only=1&user=neotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.68.205.13
country_id: 6252001
description:
[2025-12-30 21:52:52 +0530] info [cpaneld] 99.68.205.13 - neotec "GET /login/?login_only=1&user=neotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 21:54:20 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cZuayi1H1mto7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:55:01 host2 sshd[2171604]: Disconnected from invalid user ftpuser 187.33.59.116 port 60595 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Dec 30 21:55:44 host2 sshd[2172231]: Disconnected from invalid user deployer 187.33.59.116 port 38502 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 21:56:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<mgrx0C1Hjk6i8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 21:57:47 host2 sshd[2173562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.157
country_id: 1880251
description:
Dec 30 22:03:06 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.157, lip=66.85.158.92, session=<AAYU6i1HPYxe586d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.207
country_id: 1880251
description:
Dec 30 22:03:17 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=94.231.206.207, lip=66.85.158.92, session=<2oi26i1HKcFe587P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.153
country_id: 1880251
description:
Dec 30 22:03:33 host2 dovecot[1836975]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.153, lip=66.85.158.92, session=<rGm16y1Hd6le586Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.152
country_id: 1880251
description:
Dec 30 22:03:37 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.152, lip=66.85.158.92, session=<733s6y1Hr7Ve586Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 22:05:55 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<6xIG9C1HQi1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 22:07:16 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<BYje+C1HjI2eRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.122.47.228
country_id: 6252001
description:
[2025-12-30 22:08:29 +0530] info [cpaneld] 216.122.47.228 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.103.113.86
country_id: 6252001
description:
[2025-12-30 22:08:33 +0530] info [whostmgrd] 137.103.113.86 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.241.161.31
country_id: 6252001
description:
[2025-12-30 22:08:36 +0530] info [cpaneld] 173.241.161.31 - ahavafo "GET /login/?login_only=1&user=ahavafo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.101.43.114
country_id: 6252001
description:
[2025-12-30 22:08:38 +0530] info [cpaneld] 216.101.43.114 - ahavaf "GET /login/?login_only=1&user=ahavaf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavaf (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 22:08:19 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<2AaZ/C1H0pAv+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.154.2.144
country_id: 6252001
description:
[2025-12-30 22:08:30 +0530] info [cpaneld] 149.154.2.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.5.149
country_id: 6252001
description:
[2025-12-30 22:08:43 +0530] info [cpaneld] 38.194.5.149 - ah "GET /login/?login_only=1&user=ah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.39.108
country_id: 6252001
description:
[2025-12-30 22:08:45 +0530] info [cpaneld] 98.97.39.108 - ahavafo2 "GET /login/?login_only=1&user=ahavafo2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.255.11.99
country_id: 6252001
description:
[2025-12-30 22:08:39 +0530] info [cpaneld] 96.255.11.99 - ahava "GET /login/?login_only=1&user=ahava&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahava (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.228.165.100
country_id: 6252001
description:
[2025-12-30 22:08:40 +0530] info [cpaneld] 162.228.165.100 - ahav "GET /login/?login_only=1&user=ahav&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahav (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.126.247
country_id: 6252001
description:
[2025-12-30 22:08:31 +0530] info [cpaneld] 129.222.126.247 - ahavafoundation "GET /login/?login_only=1&user=ahavafoundation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.43.71.191
country_id: 6252001
description:
[2025-12-30 22:08:34 +0530] info [cpaneld] 149.43.71.191 - ahavafoundationlk "GET /login/?login_only=1&user=ahavafoundationlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafoundationlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.68.191
country_id: 6252001
description:
[2025-12-30 22:08:35 +0530] info [cpaneld] 67.209.68.191 - ahavafou "GET /login/?login_only=1&user=ahavafou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.244.188
country_id: 6252001
description:
[2025-12-30 22:08:41 +0530] info [cpaneld] 69.181.244.188 - aha "GET /login/?login_only=1&user=aha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.225.203.227
country_id: 6252001
description:
[2025-12-30 22:08:44 +0530] info [cpaneld] 173.225.203.227 - ahavafo1 "GET /login/?login_only=1&user=ahavafo1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ahavafo1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-30 22:11:44 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:53382: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.49
country_id: 3144096
description:
2025-12-30 22:11:54 dovecot_login authenticator failed for H=([84.211.13.49]) [84.211.13.49]:44646: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 22:12:49 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<h+qtDC5HCrczTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 22:12:24 host2 pure-ftpd[2185374]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 22:13:33 host2 dovecot[1836975]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lhhZDy5HVr4v/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.180.191.252
country_id: 6252001
description:
[2025-12-30 22:14:18 +0530] info [cpaneld] 135.180.191.252 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.79.96.252
country_id: 6252001
description:
[2025-12-30 22:14:22 +0530] info [cpaneld] 173.79.96.252 - lezzarot "GET /login/?login_only=1&user=lezzarot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.118.40
country_id: 6252001
description:
[2025-12-30 22:14:24 +0530] info [cpaneld] 107.216.118.40 - lezzar "GET /login/?login_only=1&user=lezzar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.213.243.74
country_id: 6252001
description:
[2025-12-30 22:14:25 +0530] info [cpaneld] 74.213.243.74 - lezza "GET /login/?login_only=1&user=lezza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.238.82.194
country_id: 6252001
description:
[2025-12-30 22:14:29 +0530] info [cpaneld] 24.238.82.194 - lezzaro1 "GET /login/?login_only=1&user=lezzaro1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.195.4
country_id: 6252001
description:
[2025-12-30 22:14:30 +0530] info [cpaneld] 70.170.195.4 - lezzaro2 "GET /login/?login_only=1&user=lezzaro2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.13.170.221
country_id: 6252001
description:
[2025-12-30 22:14:27 +0530] info [cpaneld] 172.13.170.221 - lez "GET /login/?login_only=1&user=lez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.237.35.92
country_id: 6252001
description:
[2025-12-30 22:14:19 +0530] info [cpaneld] 68.237.35.92 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.29.126
country_id: 6252001
description:
[2025-12-30 22:14:21 +0530] info [whostmgrd] 167.248.29.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.135.102
country_id: 6252001
description:
[2025-12-30 22:14:23 +0530] info [cpaneld] 216.49.135.102 - lezzaro "GET /login/?login_only=1&user=lezzaro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.26.205.236
country_id: 6252001
description:
[2025-12-30 22:14:26 +0530] info [cpaneld] 75.26.205.236 - lezz "GET /login/?login_only=1&user=lezz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.186.163.151
country_id: 6252001
description:
[2025-12-30 22:14:20 +0530] info [cpaneld] 71.186.163.151 - lezzarotech "GET /login/?login_only=1&user=lezzarotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.236.126.115
country_id: 6252001
description:
[2025-12-30 22:14:22 +0530] info [cpaneld] 69.236.126.115 - lezzarotechcom "GET /login/?login_only=1&user=lezzarotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.254.74
country_id: 6252001
description:
[2025-12-30 22:14:28 +0530] info [cpaneld] 73.205.254.74 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.174.29.15
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 192.174.29.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.239.76.43
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 141.239.76.43 - sobaher1 "GET /login/?login_only=1&user=sobaher1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.249.21
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.249.21 - sobah "GET /login/?login_only=1&user=sobah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.132.239.86
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.132.239.86 - sob "GET /login/?login_only=1&user=sob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sob (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.123.15.82
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 163.123.15.82 - sobaherb "GET /login/?login_only=1&user=sobaherb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.220.2.129
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.220.2.129 - sobaher "GET /login/?login_only=1&user=sobaher&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.2.64.24
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.2.64.24 - sobahe "GET /login/?login_only=1&user=sobahe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobahe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.159.209.79
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.159.209.79 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.112.138
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.112.138 - sobaherbal "GET /login/?login_only=1&user=sobaherbal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.62.160
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.170.62.160 - sobaherbalcom "GET /login/?login_only=1&user=sobaherbalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaherbalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.62.68.17
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.62.68.17 - sobaher2 "GET /login/?login_only=1&user=sobaher2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sobaher2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.175.147.148
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.175.147.148 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.55.205
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.5.55.205 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.18.144.221
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.18.144.221 - asrgrouplk "GET /login/?login_only=1&user=asrgrouplk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrouplk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.200.244.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 151.200.244.16 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.210.130
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.2.210.130 - asrgrou "GET /login/?login_only=1&user=asrgrou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgrou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.61.78.33
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.61.78.33 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.90.156.247
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.90.156.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.185.233.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.185.233.122 - asrgroup "GET /login/?login_only=1&user=asrgroup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.102.101.181
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.102.101.181 - asrgro "GET /login/?login_only=1&user=asrgro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.16.244.27
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.16.244.27 - asrgr "GET /login/?login_only=1&user=asrgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrgr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.0.5
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.0.5 - asrg "GET /login/?login_only=1&user=asrg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asrg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.109.67.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.109.67.89 - asr "GET /login/?login_only=1&user=asr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user asr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.226.106.167
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.226.106.167 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 22:23:08 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<aJeJMS5HoJZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 22:23:46 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<1bTdMy5H3uIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 22:24:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<SPfWNC5H+NeYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:24:30 host2 sshd[11325]: Disconnected from invalid user test 154.36.158.64 port 48500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 22:24:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Q0E1OC5HQIai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 22:29:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+qhISC5HRJcjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.49.220.61
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.49.220.61 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.63.205.14
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.63.205.14 - age "GET /login/?login_only=1&user=age&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user age (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.164.4
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.170.164.4 - agental1 "GET /login/?login_only=1&user=agental1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.46.215.161
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.46.215.161 - agentallianzcom "GET /login/?login_only=1&user=agentallianzcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentallianzcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.102.73.112
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.102.73.112 - agen "GET /login/?login_only=1&user=agen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.8.83
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.8.83 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.45.97.129
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.45.97.129 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.172.192.235
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.172.192.235 - agentallianz "GET /login/?login_only=1&user=agentallianz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User agentallianz has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.125.184.74
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.125.184.74 - agenta "GET /login/?login_only=1&user=agenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agenta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.252.221.6
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.252.221.6 - agent "GET /login/?login_only=1&user=agent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.47.35.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 156.47.35.141 - agental2 "GET /login/?login_only=1&user=agental2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:30:11 host2 sshd[13981]: Disconnected from invalid user admin 154.36.158.64 port 57342 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.226.112.102
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 66.226.112.102 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.184.33.124
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.184.33.124 - agentall "GET /login/?login_only=1&user=agentall&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentall (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.63.175.86
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.63.175.86 - agental "GET /login/?login_only=1&user=agental&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agental (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:31:34 host2 sshd[15129]: Disconnected from invalid user ali 154.36.158.64 port 56410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-30 22:32:08 dovecot_plain authenticator failed for H=(gurersess) [12.150.243.22]:54890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 22:34:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<b5uRWC5HOotn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 22:34:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<pNK8WC5HaIpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 22:34:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<L5I+Wi5H1LUv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:35:27 host2 sshd[18577]: Disconnected from invalid user ubuntu 154.36.158.64 port 49426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.36.158.64
country_id: 1861060
description:
Dec 30 22:36:08 host2 sshd[19107]: Disconnected from invalid user postgres 154.36.158.64 port 41972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 22:38:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<pjMlZy5HSpqeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 30 22:40:21 host2 sshd[22388]: Disconnected from invalid user cssserver 103.171.85.115 port 41852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-30 22:41:46 dovecot_plain authenticator failed for H=c-76-106-163-189.hsd1.fl.comcast.net (urerize) [76.106.163.189]:46184: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2025-12-30 22:42:00 dovecot_login authenticator failed for H=(cm-178.232.148.129.get.no) [178.232.148.129]:60992: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 30 22:41:11 host2 sshd[22997]: Disconnected from invalid user story 103.171.85.115 port 39698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-30 22:42:15 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:42673: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-30 22:42:42 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:33601: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.115
country_id: 1643084
description:
Dec 30 22:42:06 host2 sshd[23560]: Disconnected from invalid user ftp-user 103.171.85.115 port 45758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 22:44:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<d5f3fC5HLssjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 22:45:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<8NlggC5HbNSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 22:46:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<8KNhhC5HcN2eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-30 22:49:19 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:13767: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.84.186
country_id: 294640
description:
2025-12-30 22:50:04 dovecot_login authenticator failed for H=(2-54-84-186.orange.net.il) [2.54.84.186]:36726: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.219.234.249
country_id: 6252001
description:
[2025-12-30 22:51:16 +0530] info [cpaneld] 104.219.234.249 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 22:52:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<8Y7gmy5HBsOeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 22:52:58 host2 sshd[33474]: Disconnected from invalid user breonna 62.60.131.157 port 38335 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 22:52:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<UNKImS5HSnCi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 22:52:41 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<HKtAmy5HIKUFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-12-30 22:52:43 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (incyl) [71.229.43.123]:36644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 22:53:34 host2 sshd[34133]: Disconnected from invalid user admin 2.57.121.112 port 10433 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.17.227
country_id: 1643084
description:
Dec 30 22:55:14 host2 sshd[35989]: Disconnected from invalid user julien 222.124.17.227 port 44188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 30 22:56:09 host2 sshd[36933]: Disconnected from invalid user sdbadmin 142.93.126.22 port 35686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 22:56:18 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<C2U3qC5HruRo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Dec 30 22:56:41 host2 sshd[37340]: Disconnected from invalid user test2 8.243.64.226 port 43408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 22:57:32 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<RDOfrC5HKhFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 22:57:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Qn/0rS5HFMYvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 222.124.17.227
country_id: 1643084
description:
Dec 30 22:59:11 host2 sshd[39117]: Disconnected from invalid user elsearch 222.124.17.227 port 50586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.98.75
country_id: 3057568
description:
Dec 30 23:00:17 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=31.134.98.75, lip=66.85.158.91, TLS, session=<4fSUtS5HOBAfhmJL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.213
country_id: 3469034
description:
Dec 30 23:00:55 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<charanaw>, method=PLAIN, rip=190.89.136.213, lip=66.85.158.91, TLS, session=<h0Y6ty5HEYa+WYjV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Dec 30 23:01:12 host2 sshd[41006]: Disconnected from invalid user alpha 8.243.64.226 port 51696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:02:58 host2 sshd[42109]: Disconnected from invalid user alpha 130.250.191.234 port 43646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.64.226
country_id: 3686110
description:
Dec 30 23:02:29 host2 sshd[41819]: Disconnected from invalid user admin 8.243.64.226 port 46402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Dec 30 23:03:11 host2 sshd[42428]: Disconnected from invalid user mhd 8.243.64.226 port 52864 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.137.173
country_id: 6252001
description:
[2025-12-30 23:03:29 +0530] info [whostmgrd] 104.5.137.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.213.86.123
country_id: 6252001
description:
[2025-12-30 23:03:31 +0530] info [cpaneld] 47.213.86.123 - saar "GET /login/?login_only=1&user=saar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.37.178
country_id: 6252001
description:
[2025-12-30 23:03:32 +0530] info [cpaneld] 98.97.37.178 - saa "GET /login/?login_only=1&user=saa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.25.99.136
country_id: 6252001
description:
[2025-12-30 23:03:35 +0530] info [cpaneld] 75.25.99.136 - sa "GET /login/?login_only=1&user=sa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sa (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:03:42 host2 sshd[42809]: Disconnected from invalid user admin 130.250.191.234 port 56500 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.96.183.248
country_id: 6252001
description:
[2025-12-30 23:03:25 +0530] info [cpaneld] 199.96.183.248 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.132.131.24
country_id: 6252001
description:
[2025-12-30 23:03:28 +0530] info [cpaneld] 76.132.131.24 - saara "GET /login/?login_only=1&user=saara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.215.228.119
country_id: 6252001
description:
[2025-12-30 23:03:26 +0530] info [cpaneld] 74.215.228.119 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.128.233.172
country_id: 6252001
description:
[2025-12-30 23:03:30 +0530] info [cpaneld] 107.128.233.172 - saaralk "GET /login/?login_only=1&user=saaralk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user saaralk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 23:04:26 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<qRFMxS5HrpieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 23:06:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<igFpyy5Hft8v+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.240
country_id: 6252001
description:
Dec 30 23:07:35 host2 pure-ftpd[45552]: (?@198.235.24.240) [INFO] New connection from 198.235.24.240


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:07:43 host2 sshd[45609]: Disconnected from invalid user admin 130.250.191.234 port 43814 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:07:03 host2 sshd[45219]: Disconnected from invalid user admin 130.250.191.234 port 57274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.234
country_id: 1269750
description:
Dec 30 23:08:23 host2 sshd[46032]: Disconnected from invalid user mhd 130.250.191.234 port 50302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Dec 30 23:10:35 host2 sshd[47863]: Disconnected from invalid user paulo 64.227.139.157 port 36476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 23:12:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<mjcT4i5Hkvl100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.7.106
country_id: 1269750
description:
Dec 30 23:14:33 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.207.7.106, lip=66.85.158.91, TLS, session=<gSN76C5Hj65nzwdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.157
country_id: 3865483
description:
Dec 30 23:14:12 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.0.249.157, lip=66.85.158.91, TLS, session=<PTwa5y5HXMWzAPmd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 23:15:32 host2 pure-ftpd[51934]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[43408] [Authentication Database]=[mail] [Username]=[webmaster@lankaherbalsolutions.com] (11/10 failures) (blocked until [Wed Dec 31 17:45:43 2025 UTC/Wed Dec 31 23:15:43 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 23:15:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<NXzD7S5HkKkv/AU1>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[42102] [Authentication Database]=[mail] [Username]=[no-reply@lankaherbalsolutions.com] (10/10 failures) (blocked until [Wed Dec 31 17:46:53 2025 UTC/Wed Dec 31 23:16:53 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 23:16:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<kWz28S5HdqQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 23:17:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<0D1a8i5HHs6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 23:18:41 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<K/xC+C5Hir+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.151.168
country_id: 6252001
description:
2025-12-30 23:19:09 dovecot_login authenticator failed for H=47-145-151-168.fdr01.blpk.ca.ip.frontiernet.net [47.145.151.168]:45906: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-12-30 23:19:52 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:57418: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 23:21:23 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Ki7tAS9H3MozTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.117.114
country_id: 3865483
description:
2025-12-30 23:22:03 dovecot_login authenticator failed for H=(red.170.233.117.114.ssservicios.com.ar) [170.233.117.114]:54269: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-30 23:22:22 dovecot_login authenticator failed for H=([188.124.142.221]) [188.124.142.221]:43605: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 23:25:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<HIuhES9HjMBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 23:26:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7WOKEi9HZJkjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[39268] [Authentication Database]=[mail] [Username]=[support@anandaobauae.org] (12/10 failures) (blocked until [Wed Dec 31 17:56:00 2025 UTC/Wed Dec 31 23:26:00 2025 LOCAL])


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 23:27:37 host2 sshd[61624]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 23:27:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5K1FGS9Hyuln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 23:28:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ji8WHS9H9N9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 23:30:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<DFQMIS9HWNoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 30 23:34:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<eCREMi9HwpIFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 23:36:49 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dvQZOS9HysAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 30 23:38:37 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<0ueLPy9H6KvE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-30 23:40:33 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:47740: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 23:40:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<GUG7Ry9H9uMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-30 23:41:03 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:63548: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 23:41:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<BQGTSy9HnNGYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.74.192.200
country_id: 2186224
description:
2025-12-30 23:41:21 dovecot_login authenticator failed for H=([202.74.192.200]) [202.74.192.200]:36391: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 23:44:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<aAvhUi9HWIieRdY+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 23:45:41 host2 sshd[77099]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 23:48:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<oabzYS9HgBKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 23:49:08 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<skolZS9Hqjxniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.19.19.75
country_id: 3175395
description:
Dec 30 23:49:31 host2 sshd[81118]: Disconnected from invalid user erp 87.19.19.75 port 44268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.239.10.198
country_id: 357994
description:
2025-12-30 23:50:32 dovecot_login authenticator failed for H=([154.239.10.205]) [154.239.10.198]:59564: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-30 23:51:03 dovecot_login authenticator failed for H=([115.247.159.106]) [115.247.159.106]:32972: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-30 23:53:02 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (graph) [24.1.200.187]:48430: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-30 23:53:21 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:50525: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 30 23:53:25 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<GOJzdC9H0p7E+2YX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.19.19.75
country_id: 3175395
description:
Dec 30 23:53:40 host2 sshd[85237]: Disconnected from invalid user elasticsearch 87.19.19.75 port 35820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2025-12-30 23:53:55 dovecot_login authenticator failed for H=(cm-178.232.148.129.get.no) [178.232.148.129]:45966: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.19.19.75
country_id: 3175395
description:
Dec 30 23:54:47 host2 sshd[86609]: Disconnected from invalid user lighthouse 87.19.19.75 port 33762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.19.19.75
country_id: 3175395
description:
Dec 30 23:55:21 host2 sshd[87277]: Disconnected from invalid user esmat 87.19.19.75 port 44866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2025-12-30 23:58:04 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:46444: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-30 23:58:17 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:51617: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 00:00:38 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<QM9Dji9HvoNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 00:00:53 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<5qYnjy9HeLYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 00:01:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<aP6Tki9H0JaeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 00:05:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<jLbnnS9HbsAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 00:05:05 host2 sshd[97035]: Disconnected from invalid user admin 2.57.121.112 port 50887 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.157.139.221
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 175.157.139.221 - fhbhealt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 00:07:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<adyhpS9HXrkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 00:07:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<wjjkpS9H2qCeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 00:08:38 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<n3Lkqi9HgWB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 00:12:33 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<wAzluC9H0pSi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 00:18:18 host2 pure-ftpd[111510]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-31 00:18:25 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:55928: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-31 00:18:15 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:45274: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 00:19:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3pdE0C9HTrkv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 00:20:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Ozec1i9HBLEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 00:22:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<iP+E2y9HuLpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 00:22:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<31bI3C9H3OGeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 00:23:19 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EtNe3y9HxuCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 00:23:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<58wE4C9HQq8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 00:24:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<33ms4i9H3LZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 00:25:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<upaz5i9HBt0zTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 00:26:07 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59680: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Dec 31 00:29:12 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<clmW9C9HIvOnXpI6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 00:29:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<O1sj9y9HPMNCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 31 00:33:28 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<zSDQAzBHtjtChJmN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 00:37:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<mDCIEzBHUMgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 00:38:38 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<neUtFjBHGDUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 00:40:40 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<r4lvHTBHNoIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 00:41:22 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<A8bzHzBHNLaeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 00:41:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<UT5sITBHnBZniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.81
country_id: 6252001
description:
Dec 31 00:42:13 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.81, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<P5UiIzBHEcHG6xhR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 00:44:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<I1YoLDBHSpyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2025-12-31 00:48:47 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [102.132.29.166]:64827: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.24.210.58
country_id: 6252001
description:
2025-12-31 00:48:58 dovecot_login authenticator failed for H=72-24-210-58.cpe.sparklight.net [72.24.210.58]:49057: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.244.170
country_id: 2921044
description:
Dec 31 00:54:49 host2 pure-ftpd[149766]: (?@209.38.244.170) [INFO] New connection from 209.38.244.170


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.199.186
country_id: 2921044
description:
Dec 31 00:54:48 host2 pure-ftpd[149759]: (?@46.101.199.186) [INFO] New connection from 46.101.199.186


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 00:56:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<bS6CVTBHTsanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-31 00:58:22 dovecot_login authenticator failed for H=([125.20.183.201]) [27.123.90.94]:38658: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.244.246
country_id: 2921044
description:
Dec 31 00:58:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.244.246, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<7C5TXTBHr4rRJvT2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-31 00:58:48 dovecot_login authenticator failed for H=([182.95.178.154]) [182.95.178.154]:44890: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 00:59:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<v6WgYDBH8KieRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-31 00:59:53 dovecot_plain authenticator failed for H=(farsequal) [64.72.74.162]:44475: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.193.56
country_id: 2921044
description:
Dec 31 00:59:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.193.56, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tk58XzBHmhkuZcE4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 01:01:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Ez/7ZzBHJqqYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-31 01:01:48 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (anrismomb) [73.197.236.163]:51050: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:04:15 host2 sshd[160236]: Disconnected from invalid user taufik 103.210.21.178 port 52656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 01:05:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<CgOBdDBHALV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 01:05:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<kqGndDBHlKEv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.114.56.148
country_id: 6251999
description:
Dec 31 01:05:12 host2 sshd[161983]: Disconnected from invalid user botuser 167.114.56.148 port 57384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 01:05:36 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<VOCidjBHYvJo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 31 01:05:53 host2 sshd[162887]: Disconnected from invalid user bot 12.189.234.28 port 35892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 31 01:06:38 host2 sshd[163670]: Disconnected from invalid user steam 152.32.239.90 port 48154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 01:06:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Q+gHezBHALmi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 31 01:07:14 host2 sshd[164296]: Disconnected from invalid user taufik 152.32.239.90 port 59766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Dec 31 01:09:34 host2 sshd[166505]: Disconnected from invalid user sri 152.32.239.90 port 51582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 31 01:09:08 host2 sshd[166122]: Disconnected from invalid user taufik 12.189.234.28 port 42825 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.102.4.12
country_id: 298795
description:
Dec 31 01:09:31 host2 sshd[166443]: Disconnected from invalid user sambauser 94.102.4.12 port 57954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 31 01:09:34 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<5cz1hDBHe/7CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:09:43 host2 sshd[166647]: Disconnected from invalid user app 103.210.21.178 port 51384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:10:20 host2 sshd[167529]: Disconnected from invalid user bitwarden 103.210.21.178 port 51806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 01:10:46 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<VOAYiTBHIK8FhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:10:56 host2 sshd[168255]: Disconnected from invalid user botuser 103.210.21.178 port 44072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 31 01:10:10 host2 sshd[167303]: Disconnected from invalid user 3 12.189.234.28 port 54463 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 31 01:11:30 host2 sshd[168855]: Disconnected from invalid user ubuntu 103.210.21.178 port 59844 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 01:15:17 host2 sshd[173691]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.88
country_id: 6252001
description:
Dec 31 01:15:49 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.88, lip=66.85.158.92, session=<H9NMmzBH14xAPpxY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 31 01:16:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.92, TLS: Connection closed, session=<ssr9mzBH9n9APpxQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-12-31 01:16:37 dovecot_login authenticator failed for H=([118.26.153.102]) [118.26.153.102]:52514: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 31 01:16:24 host2 sshd[175086]: Disconnected from invalid user user7 198.98.56.227 port 49712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Dec 31 01:16:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.137, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PkoEnjBHMHhAPsWJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Dec 31 01:16:54 host2 dovecot[1566]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, session=<ZWYpnzBHZk6s7ORz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 31 01:16:13 host2 dovecot[1566]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.92, session=<ms66nDBHYkhAPpxQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-12-31 01:16:15 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:47632: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.140
country_id: 6252001
description:
Dec 31 01:16:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.140, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SBHxnDBHff9APsWM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 01:17:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<MUatnzBHEutn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.254.237
country_id: 2658434
description:
Dec 31 01:17:18 host2 pure-ftpd[176046]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.254.237
country_id: 2658434
description:
Dec 31 01:17:22 host2 pure-ftpd[176117]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 31 01:17:56 host2 sshd[176714]: Disconnected from invalid user amir 198.98.56.227 port 45166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 01:18:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<OU+ppTBHJLEvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:19:03 host2 sshd[178037]: Disconnected from invalid user dad 66.42.241.199 port 47434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:19:33 host2 sshd[178508]: Disconnected from invalid user testuser 66.42.241.199 port 34038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 01:19:48 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<KJpiqTBHzoNnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:20:03 host2 sshd[179232]: Disconnected from invalid user lol 66.42.241.199 port 59294 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 01:20:26 host2 pure-ftpd[179758]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:20:33 host2 sshd[179865]: Disconnected from invalid user samba 66.42.241.199 port 54534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Dec 31 01:21:12 host2 sshd[180601]: Disconnected from invalid user zwj 43.240.13.18 port 37322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.42.241.199
country_id: 6252001
description:
Dec 31 01:21:38 host2 sshd[181013]: Disconnected from invalid user payroll 66.42.241.199 port 42922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 01:21:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5ntMsDBHcOAjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Dec 31 01:22:47 host2 sshd[182324]: Disconnected from invalid user ubuntu 187.170.3.81 port 48100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.170.3.81
country_id: 3996063
description:
Dec 31 01:23:52 host2 sshd[183612]: Disconnected from invalid user zs 187.170.3.81 port 60306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 01:24:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<O2iTuDBHEJQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 01:26:26 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<j8gjwTBHGKQzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.123
country_id: 6252001
description:
Dec 31 01:26:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.123, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cT1jwjBHtdbG6xh7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Dec 31 01:29:04 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wh6lyjBH0mVAPpyO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Dec 31 01:29:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pb6lyzBHqIxAPpyO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 01:30:58 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<VTdd0TBHOp4zTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.154.114
country_id: 6251999
description:
Dec 31 01:32:41 host2 dovecot[1566]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=147.182.154.114, lip=66.85.158.91, TLS, session=<rzqa1zBHkN6Ttppy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 01:33:15 host2 sshd[195786]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.240.13.18
country_id: 1819730
description:
Dec 31 01:34:12 host2 sshd[196762]: Disconnected from invalid user runner 43.240.13.18 port 53774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 01:34:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<DDfR3TBHD0Fniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 01:34:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<lpbT3jBHMrJCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.81
country_id: 953987
description:
Dec 31 01:34:59 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=102.64.34.81, lip=66.85.158.91, TLS, session=<De2x3jBHRLpmQCJR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.132.11
country_id: 99237
description:
Dec 31 01:35:18 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=65.20.132.11, lip=66.85.158.91, TLS, session=<vNvu3zBHfeVBFIQL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 01:36:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hidh5jBHqocjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Dec 31 01:37:51 host2 sshd[201159]: Disconnected from invalid user pt 43.240.13.18 port 47890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 01:38:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<sI7C6zBH8uKeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 31 01:38:57 host2 sshd[202208]: Disconnected from invalid user user 2.57.121.25 port 25962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 01:39:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<LLtx7jBHzMieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 01:41:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<eZ0G9zBHlP2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 31 01:43:22 host2 sshd[206771]: Disconnected from invalid user next 172.200.228.35 port 49468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 01:45:40 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<KfLtBTFHRrsv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.44.98.97
country_id: 1861060
description:
2025-12-31 01:46:37 dovecot_login authenticator failed for H=v163-44-98-97.4zjh.static.cnode.jp [163.44.98.97]:46218: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 01:46:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<PYPKCTFHHosyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 31 01:46:52 host2 sshd[210893]: Disconnected from invalid user rui 172.200.228.35 port 53824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-31 01:46:56 dovecot_login authenticator failed for H=(cm-84.211.11.216.get.no) [84.211.11.216]:56862: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 31 01:47:25 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<7xQzDDFHmtUFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:49:43 host2 sshd[214097]: Disconnected from invalid user minh 172.96.182.111 port 59900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 01:53:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<slFYITFH2qeeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:53:31 host2 sshd[218648]: Disconnected from invalid user User 172.96.182.111 port 46760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:54:34 host2 sshd[220161]: Disconnected from invalid user sshuser 172.96.182.111 port 42586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:55:36 host2 sshd[221446]: Disconnected from invalid user rose 172.96.182.111 port 38586 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 172.96.182.111
country_id: 6252001
description:
Dec 31 01:56:06 host2 sshd[222272]: Received disconnect from 172.96.182.111 port 50616:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 01:57:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<VXbPLjFHosOeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 31 01:57:09 host2 sshd[224086]: Disconnected from invalid user user7 103.172.204.220 port 39438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-31 01:57:55 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:59988: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-31 01:58:21 dovecot_login authenticator failed for H=179-125-169-77.static.desktop.com.br [179.125.169.77]:41193: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 31 01:59:19 host2 sshd[226958]: Disconnected from invalid user borg 103.172.204.220 port 53408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.150
country_id: 3865483
description:
Dec 31 02:00:48 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.124.218.150, lip=66.85.158.91, TLS, session=<j7YROzFHu7+6fNqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 02:00:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<wfVjOjFHINui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.184
country_id: 953987
description:
Dec 31 02:00:28 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.129.53.184, lip=66.85.158.91, TLS, session=<PZ+nOTFH4JlmgTW4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 02:00:39 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<v75wOzFH1+R100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 02:03:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<0s0fRzFHUMunrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 02:06:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<cjoMUDFHdIMv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2025-12-31 02:09:10 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:60928: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.72.168.219
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 72.72.168.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-31 02:09:31 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br [187.126.105.42]:55237: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 02:10:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<v27qXzFH9JNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 02:12:04 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<wnBQZDFHVMdn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.12.135
country_id: 2077456
description:
2025-12-31 02:14:04 dovecot_login authenticator failed for H=([101.168.12.135]) [101.168.12.135]:51754: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 31 02:14:12 host2 sshd[244337]: Disconnected from invalid user esp 103.91.246.101 port 50802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-31 02:14:38 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net [51.68.226.171]:58964: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 02:15:58 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<XjFBcjFH4spnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 31 02:16:06 host2 sshd[246705]: Disconnected from invalid user steam 103.91.246.101 port 40320 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Dec 31 02:19:49 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.91, session=<CuAqgDFHBNVAPpyi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 02:19:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0TddgDFHmMIjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Dec 31 02:20:14 host2 dovecot[1566]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.91, session=<zJKngTFHcApAPpyi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 02:20:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<fyPggTFHUpUFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 31 02:22:47 host2 sshd[254542]: Disconnected from invalid user test2 103.91.246.101 port 55578 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 02:22:56 host2 pure-ftpd[254723]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 02:23:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<ndErjDFHBKaYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 31 02:23:22 host2 sshd[255304]: Disconnected from invalid user ubuntu 103.91.246.101 port 51754 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 02:27:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<0RySmjFHJyBniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 02:27:30 host2 sshd[260332]: Disconnected from invalid user admin 2.57.121.112 port 65414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.182.89
country_id: 2921044
description:
Dec 31 02:29:58 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.182.89, lip=66.85.158.91, session=<Pfx5pDFHVRCkXLZZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.65.144
country_id: 2921044
description:
Dec 31 02:29:59 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.65.144, lip=66.85.158.91, session=<NI1/pDFHVreGekGQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 02:29:40 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SwFHozFHhuQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 31 02:29:46 host2 sshd[263193]: Disconnected from invalid user dev 210.79.142.221 port 37276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 02:30:13 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<aWc/pTFHgqgvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.101
country_id: 1819730
description:
Dec 31 02:31:49 host2 sshd[265791]: Disconnected from invalid user deploy 154.83.15.101 port 50974 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 31 02:32:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<1mGrqzFHTqDE+2YT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 02:33:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<EBuPrzFHfOEzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 31 02:33:21 host2 sshd[267736]: Disconnected from invalid user daniel 107.155.55.174 port 60972 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 31 02:33:32 host2 sshd[267924]: Disconnected from invalid user git 210.79.142.221 port 56594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 31 02:34:17 host2 sshd[268996]: Disconnected from invalid user git 210.79.142.221 port 35550 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.227.142
country_id: 2921044
description:
Dec 31 02:34:25 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=209.38.227.142, lip=66.85.158.91, session=<zZtbtDFHExzRJuOO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.65.144
country_id: 2921044
description:
Dec 31 02:34:26 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.65.144, lip=66.85.158.91, session=<SaJrtDFHHmiGekGQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 31 02:35:41 host2 sshd[270855]: Disconnected from invalid user ubuntu 107.155.55.174 port 47492 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 02:35:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sXFUtzFH5qUjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.214.62
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.214.62] [Remote Port]=[57668] [Authentication Database]=[mail] [Username]=[webmaster@melanifinefood.com] (12/10 failures) (blocked until [Wed Dec 31 21:06:56 2025 UTC/Thu Jan  1 02:36:56 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 02:36:58 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<yvFhvTFHROGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 02:36:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<XEV4vDFHAMunrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.101
country_id: 1819730
description:
Dec 31 02:36:45 host2 sshd[272058]: Disconnected from invalid user bitrix 154.83.15.101 port 33830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 31 02:37:07 host2 sshd[272651]: Disconnected from invalid user sysadmin 210.79.142.221 port 41810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 02:37:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<0B4SwDFHkr8zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.101
country_id: 1819730
description:
Dec 31 02:37:58 host2 sshd[273630]: Disconnected from invalid user centos 154.83.15.101 port 33806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2025-12-31 02:38:00 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:36546: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-31 02:38:15 dovecot_login authenticator failed for H=([102.38.3.179]) [102.38.3.179]:47478: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.50
country_id: 1643084
description:
Dec 31 02:38:31 host2 sshd[274274]: Disconnected from invalid user sftp 103.171.85.50 port 60682 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 31 02:38:34 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS: Connection closed, session=<Nv4+wzFHJp9ChJl5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 02:38:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<PwOYxDFHCpOi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.50
country_id: 1643084
description:
Dec 31 02:39:19 host2 sshd[275347]: Disconnected from invalid user bitrix 103.171.85.50 port 42272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 02:39:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<gz4UxjFHQM1CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 31 02:41:26 host2 sshd[278057]: Disconnected from invalid user ali 107.155.55.174 port 57468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.212
country_id: 1643084
description:
Dec 31 02:42:20 host2 sshd[279140]: Disconnected from invalid user ubuntu 157.20.32.212 port 45730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.50
country_id: 1643084
description:
Dec 31 02:45:47 host2 sshd[283763]: Disconnected from invalid user centos 103.171.85.50 port 52550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-12-31 02:45:53 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:49434: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 31 02:45:12 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oAb02jFHZE+4affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-12-31 02:45:25 dovecot_login authenticator failed for H=([152.52.234.180]) [182.95.177.118]:54334: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.32.212
country_id: 1643084
description:
Dec 31 02:48:45 host2 sshd[287291]: Disconnected from invalid user daniel 157.20.32.212 port 36000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.17.157.40
country_id: 630336
description:
2025-12-31 02:49:30 dovecot_login authenticator failed for H=([134.17.157.40]) [134.17.157.40]:51140: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.50
country_id: 1643084
description:
Dec 31 02:49:31 host2 sshd[288284]: Disconnected from invalid user jenkins 103.171.85.50 port 33996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-31 02:49:47 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca [148.170.156.248]:43194: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.155.1.17
country_id: 357994
description:
2025-12-31 02:49:54 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [196.155.1.17]:27460: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-31 02:49:18 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:48618: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 02:51:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<q8yN8jFHSr8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 02:54:41 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tfC4/DFHwp6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 02:55:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Ilps/jFHfsSeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-31 02:55:59 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (flexsitale) [87.103.126.54]:51012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 02:56:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<EvSQATJH1q0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 02:56:36 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<HrqSAzJHlFd100Db>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 03:02:14 host2 sshd[303282]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-31 03:04:29 dovecot_plain authenticator failed for H=(lonred) [5.11.141.74]:55038: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.248.36
country_id: 2921044
description:
Dec 31 03:04:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=46.101.248.36, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mn87ITJHKGouZfgk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 03:07:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<2LscKTJHaMSeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 03:07:36 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DbLpKjJHKr9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 172.58.144.203
country_id: 6252001
description:
Dec 31 03:08:12 host2 dovecot[1566]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=172.58.144.203, lip=66.85.158.91, TLS, session=<PvgVLTJHpbCsOpDL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 03:09:39 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<CUtAMjJHXtMv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.133.25
country_id: 357994
description:
2025-12-31 03:14:31 dovecot_login authenticator failed for H=([41.65.118.172]) [41.239.133.25]:52496: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-31 03:14:50 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:60146: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 03:15:06 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<iA3CRTJHLv1o7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.64
country_id: 6252001
description:
Dec 31 03:18:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.64, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<64F6UTJHesSTuYRA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 03:19:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DOlFVDJHAngjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 03:20:07 host2 sshd[324437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 03:20:23 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<sI+gWDJH/y9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 03:21:37 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Tx8NXTJHRM6eRdGr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 03:25:28 host2 pure-ftpd[330725]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.73.108
country_id: 294640
description:
2025-12-31 03:27:32 dovecot_login authenticator failed for H=(2-55-73-108.orange.net.il) [2.55.73.108]:52440: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-31 03:28:07 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:38106: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-12-31 03:29:14 dovecot_plain authenticator failed for H=(nocon) [84.238.92.245]:58273: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 03:29:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<6Dg+ejJHOOgFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-31 03:29:53 dovecot_plain authenticator failed for H=(nerolitoku) [50.231.243.28]:49778: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 03:34:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<KIVzizJHLkAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 03:35:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<iX7sjTJHvo2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 03:35:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<4ppPkDJHOKQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 03:36:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<cPoPkzJH3Bei8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:37:22 host2 sshd[344962]: Disconnected from invalid user github 63.142.241.161 port 46086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 03:39:31 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<98UOnTJHIrAzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:39:37 host2 sshd[347452]: Disconnected from invalid user admin 63.142.241.161 port 44100 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.117
country_id: 6252001
description:
Dec 31 03:40:41 host2 pure-ftpd[348810]: (?@198.235.24.117) [INFO] New connection from 198.235.24.117


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:41:20 host2 sshd[349395]: Disconnected from invalid user roman 63.142.241.161 port 40486 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 03:43:02 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<0ISfqTJHxKIvWBNS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.238.230
country_id: 6252001
description:
Dec 31 03:42:07 host2 pure-ftpd[350304]: (?@161.35.238.230) [INFO] New connection from 161.35.238.230


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 03:42:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<1kuApjJHrOGnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:42:29 host2 sshd[350655]: Disconnected from invalid user rafael 63.142.241.161 port 47646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.142.241.161
country_id: 6252001
description:
Dec 31 03:43:34 host2 sshd[351808]: Disconnected from invalid user claude 63.142.241.161 port 54384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 03:44:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JFlsrTJH0JAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 03:44:34 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<vS8mrzJHTr1CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.173
country_id: 6251999
description:
2025-12-31 03:45:30 dovecot_login authenticator failed for H=([207.134.139.173]) [207.134.139.173]:47369: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.70
country_id: 1269750
description:
2025-12-31 03:45:44 dovecot_login authenticator failed for H=(nsg-corporate-70.116.187.122.airtel.in) [122.187.116.70]:48836: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 03:47:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<42ASuTJHAIKYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 03:48:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<azjRvTJHZp+i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 31 03:50:52 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<EESwxTJHtrnE+2YU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 03:52:33 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<TxC2yzJHlJZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 03:53:32 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<KhA0zzJHHsOeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.164.120
country_id: 6252001
description:
Dec 31 03:54:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=206.189.164.120, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2Rgy0jJHLtXOvaR4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.92.128
country_id: 6252001
description:
Dec 31 03:54:21 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.89.92.128, lip=66.85.158.91, TLS: Connection closed, session=<YfM/0jJHjNqfWVyA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Dec 31 03:56:05 host2 pure-ftpd[369553]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 03:58:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jKYq3zJHeKYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 03:58:26 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59081: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.72.97
country_id: 6252001
description:
Dec 31 04:02:23 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=178.128.72.97, lip=66.85.158.91, TLS, session=<J4X67jJHXOSygEhh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 04:03:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Nhte8TJH9oRn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.0.5
country_id: 6252001
description:
Dec 31 04:03:55 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=134.209.0.5, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<LtV59DJHiuuG0QAF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 169.255.57.132
country_id: 2328926
description:
Dec 31 04:04:38 host2 sshd[379836]: Disconnected from invalid user testuser 169.255.57.132 port 47346 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.197.40
country_id: 3469034
description:
Dec 31 04:04:59 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.93.197.40, lip=66.85.158.91, TLS, session=<jHws9zJHasCxXcUo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.200
country_id: 953987
description:
Dec 31 04:05:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.37.200, lip=66.85.158.91, TLS, session=<wIVo+DJHmORmQCXI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 04:05:25 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<jH2x+TJHnpsyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 31 04:06:12 host2 sshd[382219]: Disconnected from invalid user spider 36.91.81.195 port 37152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-31 04:07:48 dovecot_login authenticator failed for H=([182.95.54.10]) [182.95.54.10]:43084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 169.255.57.132
country_id: 2328926
description:
Dec 31 04:07:14 host2 sshd[383272]: Disconnected from invalid user sig 169.255.57.132 port 39730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-31 04:08:08 dovecot_login authenticator failed for H=([62.97.161.159]) [62.97.161.159]:54885: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-31 04:08:20 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (lime36.static.otenet.gr) [62.103.27.217]:62097: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 31 04:09:03 host2 sshd[385124]: Disconnected from invalid user elena 36.91.81.195 port 56878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 31 04:09:43 host2 sshd[385823]: Disconnected from invalid user ubuntu 146.59.95.254 port 47374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 04:09:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<o1XGCTNH9oZnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 169.255.57.132
country_id: 2328926
description:
Dec 31 04:09:07 host2 sshd[385180]: Disconnected from invalid user spider 169.255.57.132 port 54116 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 169.255.57.132
country_id: 2328926
description:
Dec 31 04:10:16 host2 sshd[386600]: Disconnected from invalid user administrador 169.255.57.132 port 51636 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.61.238
country_id: 6252001
description:
Dec 31 04:10:47 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.61.238, lip=66.85.158.92, TLS: Connection closed, session=<uNUHDTNHMOud5j3u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.155.151
country_id: 6252001
description:
Dec 31 04:10:47 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=157.230.155.151, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<b5gKDTNH5NOd5puX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 31 04:10:56 host2 sshd[387664]: Disconnected from invalid user luis 36.91.81.195 port 40510 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 31 04:11:45 host2 sshd[388921]: Received disconnect from 146.59.95.254 port 45012:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 04:13:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<NZ3eFzNHmw9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 04:13:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<0icFGDNH7tWnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 04:13:13 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<9iuZFTNHSrUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-31 04:13:22 dovecot_login authenticator failed for H=(nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:52834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-31 04:13:48 dovecot_login authenticator failed for H=([95.164.177.6]) [95.164.177.6]:34248: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.152.20
country_id: 6252001
description:
Dec 31 04:14:43 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.105.152.20, lip=66.85.158.92, TLS, session=<BPwSGzNHZMqsaZgU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 23.92.30.226
country_id: 6252001
description:
Dec 31 04:16:08 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=23.92.30.226, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<TfQiIDNHbuUXXB7i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.5.238.101
country_id: 3175395
description:
2025-12-31 04:18:52 dovecot_login authenticator failed for H=host-87-5-238-101.retail.telecomitalia.it [87.5.238.101]:43706: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 04:19:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<TZRFKjNHTP1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 04:18:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<e1RlJzNHosUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.78.232
country_id: 690791
description:
Dec 31 04:18:22 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=194.44.78.232, lip=66.85.158.91, TLS, session=<lOgrJzNHWqnCLE7o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-31 04:18:41 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:45280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.115
country_id: 3865483
description:
Dec 31 04:18:45 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=179.0.250.115, lip=66.85.158.91, TLS, session=<Yf5NKDNHdLyzAPpz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 04:28:01 host2 pure-ftpd[412670]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-31 04:31:04 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:55445: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.109.23
country_id: 1512440
description:
2025-12-31 04:31:21 dovecot_login authenticator failed for H=([213.230.109.23]) [213.230.109.23]:47935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 04:33:16 host2 sshd[420207]: Disconnected from invalid user admin 2.57.121.112 port 20307 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 04:33:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<QWjHXTNHDpueRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 04:33:34 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<K6VdXjNHEmQjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2025-12-31 04:34:15 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:43916: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 04:34:25 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<32lpYTNHuMueRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 04:34:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9Eh6YjNHaCmi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-31 04:34:55 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:41354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.168.100.250
country_id: 6252001
description:
[2025-12-31 04:39:25 +0530] info [cpaneld] 206.168.100.250 - ayuzo "GET /login/?login_only=1&user=ayuzo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.59.142.120
country_id: 6252001
description:
[2025-12-31 04:39:26 +0530] info [cpaneld] 198.59.142.120 - ayuz "GET /login/?login_only=1&user=ayuz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.100.167
country_id: 6252001
description:
[2025-12-31 04:39:12 +0530] info [cpaneld] 74.105.100.167 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.48.36.189
country_id: 6252001
description:
[2025-12-31 04:39:15 +0530] info [whostmgrd] 99.48.36.189 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.70.40.149
country_id: 6252001
description:
[2025-12-31 04:39:16 +0530] info [cpaneld] 75.70.40.149 - ayuzonel "GET /login/?login_only=1&user=ayuzonel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.186.229.108
country_id: 6252001
description:
[2025-12-31 04:39:22 +0530] info [cpaneld] 99.186.229.108 - ayuzon "GET /login/?login_only=1&user=ayuzon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.41.46.147
country_id: 6252001
description:
[2025-12-31 04:39:28 +0530] info [cpaneld] 38.41.46.147 - ay "GET /login/?login_only=1&user=ay&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ay (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.23.178.240
country_id: 6252001
description:
[2025-12-31 04:39:29 +0530] info [cpaneld] 24.23.178.240 - ayuzone1 "GET /login/?login_only=1&user=ayuzone1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 04:39:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<gDh0dDNHMu0FhXlo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.51.44
country_id: 6252001
description:
[2025-12-31 04:39:13 +0530] info [cpaneld] 184.164.51.44 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.110.224.138
country_id: 6252001
description:
[2025-12-31 04:39:16 +0530] info [cpaneld] 99.110.224.138 - ayuzonelankacom "GET /login/?login_only=1&user=ayuzonelankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.120.194.79
country_id: 6252001
description:
[2025-12-31 04:39:30 +0530] info [cpaneld] 23.120.194.79 - ayuzone2 "GET /login/?login_only=1&user=ayuzone2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.180.234.134
country_id: 6252001
description:
[2025-12-31 04:39:14 +0530] info [cpaneld] 135.180.234.134 - ayuzonelanka "GET /login/?login_only=1&user=ayuzonelanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.6.2.251
country_id: 6252001
description:
[2025-12-31 04:39:21 +0530] info [cpaneld] 64.6.2.251 - ayuzone "GET /login/?login_only=1&user=ayuzone&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.0.48
country_id: 6252001
description:
[2025-12-31 04:39:27 +0530] info [cpaneld] 98.97.0.48 - ayu "GET /login/?login_only=1&user=ayu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 04:41:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<hXntezNHVpgv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-31 04:42:28 dovecot_login authenticator failed for H=([187.161.173.2]) [187.161.173.2]:46768: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 04:42:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<9pJRfjNHWuyi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-31 04:43:08 dovecot_login authenticator failed for H=([179.185.18.67]) [179.185.18.67]:47982: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 04:45:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<fJpZiTNHEOMzTcpt>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 04:49:01 host2 sshd[441052]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 04:48:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BGI/kzNHP8h100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 04:49:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<QHUtljNHVIyeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 04:49:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<koH5ljNHHuNCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 04:50:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<DsG2mTNHrKszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 04:51:28 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<lv5onjNHktmeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 04:56:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4CborjNHRp8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 04:58:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<KeUjuTNHioZn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.123
country_id: 6252001
description:
Dec 31 04:59:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.123, lip=66.85.158.91, session=<PPh9uTNHj+DDuEx7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.127
country_id: 6252001
description:
Dec 31 04:59:11 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.127, lip=66.85.158.91, session=<6PcYujNHJarDuEx/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.97
country_id: 6252001
description:
Dec 31 04:59:24 host2 dovecot[1566]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.97, lip=66.85.158.91, session=<36HdujNHr9rDuExh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.127
country_id: 6252001
description:
Dec 31 04:59:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.127, lip=66.85.158.91, session=<W6gNuzNH2eLDuEx/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 05:03:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<J07qyjNHNrAv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 3.115.231.158
country_id: 1861060
description:
Dec 31 05:05:56 host2 sshd[459597]: Disconnected from invalid user ali 3.115.231.158 port 52550 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 05:06:51 host2 sshd[460656]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 05:07:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4tz21jNHEzpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 05:06:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nU7n1DNHhMdnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 3.115.231.158
country_id: 1861060
description:
Dec 31 05:07:47 host2 sshd[461599]: Disconnected from invalid user steam 3.115.231.158 port 46818 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:08:09 host2 sshd[462069]: Received disconnect from 102.211.209.191 port 35386:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:09:06 host2 sshd[463014]: Disconnected from invalid user Test 102.211.209.191 port 36298 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - gemtrail "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtrail (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-12-31 05:10:11 dovecot_login authenticator failed for H=([213.227.245.154]) [213.227.245.154]:50268: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 3.115.231.158
country_id: 1861060
description:
Dec 31 05:10:51 host2 sshd[464896]: Disconnected from invalid user david 3.115.231.158 port 41714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-31 05:10:23 dovecot_login authenticator failed for H=([62.97.170.80]) [62.97.170.80]:53627: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:10:32 host2 sshd[464604]: Disconnected from invalid user teste 102.211.209.191 port 48026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.65.144
country_id: 2921044
description:
Dec 31 05:11:42 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=134.122.65.144, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3Yvb5jNHKB6GekGQ>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:12:56 host2 sshd[467350]: Received disconnect from 102.211.209.191 port 37950:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:12:28 host2 sshd[466830]: Disconnected from invalid user es 102.211.209.191 port 52186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 05:12:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<yLuO6TNHJt+YNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.77
country_id: 6252001
description:
Dec 31 05:13:45 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.77, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V/A27jNH+9nN0h9N>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:13:25 host2 sshd[467861]: Disconnected from invalid user ubuntu 102.211.209.191 port 42752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Dec 31 05:15:16 host2 sshd[469851]: Disconnected from invalid user ubuntu 102.211.209.191 port 50078 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 05:15:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<WX8n8zNHDt4yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 31 05:16:53 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ZAJH+TNHYJYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 05:17:22 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<j8MI+zNHCOYjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2025-12-31 05:18:48 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:46078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-31 05:19:03 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:42368: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 05:20:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<BhLxBDRHaN2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 05:22:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Mvs1DjRHNito7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Dec 31 05:26:09 host2 sshd[481346]: Disconnected from invalid user ubuntu 177.130.248.114 port 48632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-31 05:25:27 dovecot_plain authenticator failed for H=(ingsormang) [154.144.255.208]:56752: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 31 05:26:05 host2 sshd[481291]: Disconnected from invalid user mailuser 196.204.240.61 port 34334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 31 05:27:21 host2 sshd[482518]: Disconnected from invalid user opennms 162.240.39.179 port 41456 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.183
country_id: 2635167
description:
Dec 31 05:27:44 host2 dovecot[1566]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.183, lip=66.85.158.91, TLS, session=<D441IDRHzeu594m3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 31 05:28:07 host2 sshd[483396]: Disconnected from invalid user szy 125.21.59.218 port 56170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:28:11 host2 sshd[483462]: Disconnected from invalid user pt 186.87.166.141 port 36328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 31 05:28:44 host2 sshd[484114]: Disconnected from invalid user ivan 125.21.59.218 port 41656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:28:51 host2 sshd[484228]: Disconnected from invalid user jamshid 186.87.166.141 port 47904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 31 05:29:20 host2 sshd[484728]: Disconnected from invalid user user 125.21.59.218 port 55370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 31 05:29:27 host2 sshd[484884]: Disconnected from invalid user devuser 162.240.39.179 port 33102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Dec 31 05:29:39 host2 sshd[485044]: Disconnected from invalid user rocky 85.133.253.204 port 40402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:30:11 host2 sshd[485760]: Disconnected from invalid user hassan 186.87.166.141 port 42822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 31 05:30:34 host2 sshd[486138]: Disconnected from invalid user opennms 125.21.59.218 port 54568 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 05:30:34 host2 pure-ftpd[486166]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 31 05:31:03 host2 sshd[486646]: Disconnected from invalid user mailuser 162.240.39.179 port 40954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 31 05:30:31 host2 sshd[486105]: Disconnected from invalid user ubuntu 162.240.39.179 port 57156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:30:51 host2 sshd[486385]: Disconnected from invalid user victor 186.87.166.141 port 54400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 05:31:42 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<XDhNLjRHDqmeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 05:32:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<2u6KLzRHXlWi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 31 05:32:12 host2 sshd[487667]: Disconnected from invalid user opennms 186.87.166.141 port 49316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Dec 31 05:31:26 host2 sshd[486958]: Disconnected from invalid user james 85.133.253.204 port 57222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 05:32:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+gyYMjRHXEAjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.204.240.61
country_id: 357994
description:
Dec 31 05:33:01 host2 sshd[488647]: Disconnected from invalid user ivan 196.204.240.61 port 36890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Dec 31 05:32:27 host2 sshd[487902]: Disconnected from invalid user mdm 85.133.253.204 port 52880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec 31 05:33:36 host2 sshd[489219]: Disconnected from invalid user pt 196.204.240.61 port 38922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Dec 31 05:33:50 host2 sshd[489435]: Disconnected from invalid user opennms 177.130.248.114 port 47652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Dec 31 05:35:09 host2 sshd[490852]: Disconnected from invalid user mailuser 177.130.248.114 port 48642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Dec 31 05:34:24 host2 sshd[489994]: Disconnected from invalid user monit 85.133.253.204 port 55778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 05:36:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<MrFgPjRHmLui8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.130.248.114
country_id: 3469034
description:
Dec 31 05:36:31 host2 sshd[492371]: Disconnected from invalid user pt 177.130.248.114 port 49662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 31 05:38:17 host2 sshd[494121]: Disconnected from invalid user furukawa 128.1.132.137 port 47172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.84.160.91
country_id: 1605651
description:
2025-12-31 05:39:39 dovecot_login authenticator failed for H=([185.84.160.91]) [185.84.160.91]:36226: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2025-12-31 05:40:08 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:55268: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-31 05:40:36 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:45007: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.43.27
country_id: 3144096
description:
2025-12-31 05:40:50 dovecot_login authenticator failed for H=(cm-178.232.43.27.get.no) [178.232.43.27]:47716: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-31 05:40:25 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:38346: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 05:43:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<B6e0WTRH6TJ100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 31 05:43:53 host2 sshd[500040]: Disconnected from invalid user composer 128.1.132.137 port 44288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 31 05:46:44 host2 sshd[503669]: Disconnected from invalid user neeraj 128.1.132.137 port 40186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.111.216
country_id: 226074
description:
2025-12-31 05:48:57 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [102.209.111.216]:1429: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 05:48:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lmrCaTRH8tYv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 31 05:48:24 host2 sshd[505467]: Disconnected from invalid user bitrix 128.1.132.137 port 39328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.136.169
country_id: 6252001
description:
Dec 31 05:48:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.22.136.169, lip=66.85.158.92, TLS: Connection closed, session=<BwtUazRHgrOlFoip>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 05:49:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<+GBbbzRHCK2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 05:50:18 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<XpDOcDRHDoMFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 05:52:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<+Q3qdzRH1NMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 31 05:52:31 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<pH+9eDRHzLGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 05:55:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<1J04gzRH3LBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 05:56:53 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<motPiDRHkuszTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-31 05:59:10 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-31 05:59:46 dovecot_login authenticator failed for H=([177.44.71.244]) [177.44.71.244]:40328: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.24.183.76
country_id: 6252001
description:
2025-12-31 06:00:18 dovecot_login authenticator failed for H=(173-24-183-76.client.mchsi.com) [173.24.183.76]:38060: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 06:01:26 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<iTubmDRHexdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 06:02:34 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ozKonDRHKIaeRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.234.200.125
country_id: 6252001
description:
[2025-12-31 06:03:47 +0530] info [cpaneld] 216.234.200.125 - nsteele "GET /login/?login_only=1&user=nsteele&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteele (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.66.69.169
country_id: 6252001
description:
[2025-12-31 06:03:40 +0530] info [cpaneld] 207.66.69.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.231.43.92
country_id: 6252001
description:
[2025-12-31 06:03:43 +0530] info [whostmgrd] 67.231.43.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.98.247.213
country_id: 6252001
description:
[2025-12-31 06:03:42 +0530] info [cpaneld] 68.98.247.213 - nsteeleng "GET /login/?login_only=1&user=nsteeleng&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.106.199.55
country_id: 6252001
description:
[2025-12-31 06:03:44 +0530] info [cpaneld] 70.106.199.55 - nsteelengcom "GET /login/?login_only=1&user=nsteelengcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteelengcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.130.24.56
country_id: 6252001
description:
[2025-12-31 06:03:50 +0530] info [cpaneld] 107.130.24.56 - nste "GET /login/?login_only=1&user=nste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.3.181.117
country_id: 6252001
description:
[2025-12-31 06:03:45 +0530] info [cpaneld] 172.3.181.117 - nsteelen "GET /login/?login_only=1&user=nsteelen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteelen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.29.170.217
country_id: 6252001
description:
[2025-12-31 06:03:48 +0530] info [cpaneld] 76.29.170.217 - nsteel "GET /login/?login_only=1&user=nsteel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nsteel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.41.147.54
country_id: 6252001
description:
[2025-12-31 06:03:51 +0530] info [cpaneld] 158.41.147.54 - nst "GET /login/?login_only=1&user=nst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.223.175.242
country_id: 6252001
description:
[2025-12-31 06:03:52 +0530] info [cpaneld] 74.223.175.242 - ns "GET /login/?login_only=1&user=ns&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ns (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.172.181.89
country_id: 6252001
description:
[2025-12-31 06:03:41 +0530] info [cpaneld] 67.172.181.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.157.216
country_id: 6252001
description:
[2025-12-31 06:03:49 +0530] info [cpaneld] 174.160.157.216 - nstee "GET /login/?login_only=1&user=nstee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nstee (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 06:05:19 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<s6R8pjRHQN5nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-12-31 06:07:57 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:35038: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.199.69.186
country_id: 6252001
description:
Dec 31 06:08:04 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.199.69.186, lip=66.85.158.91, TLS: Connection closed, session=</Oh6sDRH6ObGx0W6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-31 06:07:39 dovecot_login authenticator failed for H=([178.232.188.10]) [178.232.188.10]:33791: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 06:09:26 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<jQgztTRH9JsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.51
country_id: 3175395
description:
Dec 31 06:10:30 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.124.182.51, lip=66.85.158.91, TLS, session=<sbEruDRHhOW5fLYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 06:10:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eJS8uTRHsKEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.82.82
country_id: 2328926
description:
Dec 31 06:10:49 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=41.76.82.82, lip=66.85.158.91, TLS, session=<RzhEuTRHpZ8pTFJS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.19
country_id: 3865483
description:
Dec 31 06:11:13 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=179.0.252.19, lip=66.85.158.91, TLS, session=<yM15ujRHyMuzAPwT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.150.104
country_id: 6252001
description:
Dec 31 06:11:44 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.79.150.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<bJWSvTRHmKwtT5Zo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.75
country_id: 3469034
description:
Dec 31 06:11:53 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng>, method=PLAIN, rip=191.53.131.75, lip=66.85.158.91, TLS, session=<LCaavDRH3aO/NYNL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 06:14:00 host2 sshd[534645]: Disconnected from invalid user admin 2.57.121.112 port 60779 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Dec 31 06:15:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JDj2yjRHidqTuYRG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.244.206
country_id: 6252001
description:
Dec 31 06:15:39 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.127.244.206, lip=66.85.158.92, session=<i8KMyzRHwMgUf/TO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 06:16:39 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<lVX/zjRH2NcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 06:17:41 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<F5iy0jRHdoSeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.133.25
country_id: 357994
description:
2025-12-31 06:18:06 dovecot_plain authenticator failed for H=(cultrums) [41.239.133.25]:40542: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.207
country_id: 6252001
description:
Dec 31 06:18:23 host2 pure-ftpd[539639]: (?@147.185.132.207) [INFO] New connection from 147.185.132.207


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.116
country_id: 6252001
description:
Dec 31 06:23:15 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.116, lip=66.85.158.91, session=<L47B5jRHUsAUQcJ0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.17
country_id: 3175395
description:
Dec 31 06:24:02 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=195.177.113.17, lip=66.85.158.91, TLS, session=<AESJ6DRHb5LDsXER>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.127
country_id: 2300660
description:
Dec 31 06:24:22 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.44.127, lip=66.85.158.91, TLS, session=<Q7Wm6TRHe9Mpiyx/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 06:26:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<zV3m8TRHnLUyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 06:27:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<jPFC9zRHsH5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 06:29:05 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<uP2A+zRHtuWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 06:30:18 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<gmTf/zRH0IqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 06:30:42 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<I/lKATVHsrai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 06:32:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ZuZxBjVHdF0jupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 06:33:10 host2 pure-ftpd[555000]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 31 06:33:36 host2 sshd[555365]: Disconnected from invalid user user 2.57.121.25 port 38950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2025-12-31 06:37:05 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:59172: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-31 06:37:23 dovecot_login authenticator failed for H=([182.76.69.209]) [128.185.228.134]:54320: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 06:38:28 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<mlYFHTVHOOaYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 06:39:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Re/1ITVHPLx100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.214.128.30
country_id: 6252001
description:
[2025-12-31 06:44:57 +0530] info [cpaneld] 207.214.128.30 - clou "GET /login/?login_only=1&user=clou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.126.88.222
country_id: 6252001
description:
[2025-12-31 06:45:03 +0530] info [cpaneld] 76.126.88.222 - cloudto2 "GET /login/?login_only=1&user=cloudto2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.71.183.238
country_id: 6252001
description:
[2025-12-31 06:44:47 +0530] info [cpaneld] 209.71.183.238 - cloudtourssrilanka "GET /login/?login_only=1&user=cloudtourssrilanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilanka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.4.52.9
country_id: 6252001
description:
[2025-12-31 06:44:46 +0530] info [cpaneld] 50.4.52.9 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.213.57.56
country_id: 6252001
description:
[2025-12-31 06:44:55 +0530] info [cpaneld] 162.213.57.56 - cloudt "GET /login/?login_only=1&user=cloudt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.194.159.216
country_id: 6252001
description:
[2025-12-31 06:44:54 +0530] info [cpaneld] 107.194.159.216 - cloudto "GET /login/?login_only=1&user=cloudto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 06:44:24 host2 sshd[566784]: Disconnected from invalid user admin 2.57.121.112 port 30784 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.20.85.156
country_id: 6252001
description:
[2025-12-31 06:44:45 +0530] info [cpaneld] 47.20.85.156 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.75.133.154
country_id: 6252001
description:
[2025-12-31 06:44:51 +0530] info [cpaneld] 108.75.133.154 - cloudtourssrilankacom "GET /login/?login_only=1&user=cloudtourssrilankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.2.61
country_id: 6252001
description:
[2025-12-31 06:44:59 +0530] info [cpaneld] 172.56.2.61 - cl "GET /login/?login_only=1&user=cl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.209.8.96
country_id: 6252001
description:
[2025-12-31 06:44:58 +0530] info [cpaneld] 107.209.8.96 - clo "GET /login/?login_only=1&user=clo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.169.142
country_id: 6252001
description:
[2025-12-31 06:45:01 +0530] info [cpaneld] 38.194.169.142 - cloudto1 "GET /login/?login_only=1&user=cloudto1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.210.87
country_id: 6252001
description:
[2025-12-31 06:44:50 +0530] info [whostmgrd] 172.58.210.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.131.199
country_id: 6252001
description:
[2025-12-31 06:44:53 +0530] info [cpaneld] 172.59.131.199 - cloudtou "GET /login/?login_only=1&user=cloudtou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.108.2.163
country_id: 6252001
description:
[2025-12-31 06:44:56 +0530] info [cpaneld] 68.108.2.163 - cloud "GET /login/?login_only=1&user=cloud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloud (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 06:49:00 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Edi6QjVH1sKeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-31 06:50:58 dovecot_login authenticator failed for H=([182.95.20.115]) [182.95.229.142]:58288: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 06:51:56 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Vsg5TTVHVppn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-31 06:51:32 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:46110: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 06:55:13 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<xfXsWDVHQUVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 06:55:29 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<K93pWTVHfr4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 06:58:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1y8nZDVHWqxCdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.36.4
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.151.36.4 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.237.80.61
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 24.237.80.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.184.14.123
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.184.14.123 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.138.194.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 207.138.194.146 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.118.57.1
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.118.57.1 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.51.30
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.51.30 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.176.17.131
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.176.17.131 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.117.86.157
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 152.117.86.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.22.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 167.248.22.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.180.73
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.160.180.73 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.178.24.251
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.178.24.251 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.118.157
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.118.157 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 07:00:28 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<EJ6zazVHToIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 07:01:23 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<j6P8bjVH7sgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 07:04:01 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<++VseDVHjM5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 07:05:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<mIRvfDVHjOszTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-31 07:06:09 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (essnum) [24.15.216.41]:42308: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 31 07:06:30 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<pC5JgTVHvprE+2YY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.215.230.159
country_id: 6252001
description:
[2025-12-31 07:08:04 +0530] info [whostmgrd] 107.215.230.159 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.179.254.219
country_id: 6252001
description:
[2025-12-31 07:08:03 +0530] info [cpaneld] 104.179.254.219 - ksoft "GET /login/?login_only=1&user=ksoft&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoft (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.81.0
country_id: 6252001
description:
[2025-12-31 07:08:06 +0530] info [cpaneld] 172.56.81.0 - ksof "GET /login/?login_only=1&user=ksof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.200.246
country_id: 6252001
description:
[2025-12-31 07:08:07 +0530] info [cpaneld] 107.216.200.246 - kso "GET /login/?login_only=1&user=kso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.146.111
country_id: 6252001
description:
[2025-12-31 07:08:01 +0530] info [cpaneld] 140.186.146.111 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.19.176.57
country_id: 6252001
description:
[2025-12-31 07:08:02 +0530] info [cpaneld] 76.19.176.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.9.132.101
country_id: 6252001
description:
[2025-12-31 07:08:05 +0530] info [cpaneld] 75.9.132.101 - ksoftweblk "GET /login/?login_only=1&user=ksoftweblk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ksoftweblk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.10.18.111
country_id: 6252001
description:
[2025-12-31 07:08:09 +0530] info [cpaneld] 24.10.18.111 - ks "GET /login/?login_only=1&user=ks&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ks (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2025-12-31 07:08:29 dovecot_login authenticator failed for H=a4.ucndns.in [103.252.168.4]:60386: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-31 07:08:50 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:59155: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.237.143.40
country_id: 798544
description:
Dec 31 07:15:03 host2 sshd[602105]: Disconnected from invalid user sshuser 185.237.143.40 port 56686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 31 07:15:13 host2 sshd[602275]: Disconnected from invalid user ubuntu 35.210.61.208 port 48112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 07:14:37 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58454: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.151.221
country_id: 3175395
description:
Dec 31 07:14:46 host2 sshd[601669]: Disconnected from invalid user remote 151.43.151.221 port 54442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 07:15:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OjU2ozVH+nwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.10.36.217
country_id: 1643084
description:
Dec 31 07:16:58 host2 sshd[604181]: Disconnected from invalid user liyang 202.10.36.217 port 35884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.222
country_id: 1819730
description:
Dec 31 07:17:50 host2 sshd[604985]: Disconnected from invalid user github 152.32.135.222 port 54332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 31 07:17:54 host2 sshd[605122]: Disconnected from invalid user mikey 35.210.61.208 port 44868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 07:18:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<aOOXqjVHAJcv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 31 07:18:03 host2 sshd[605340]: Disconnected from invalid user sftpuser 52.224.240.74 port 51174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.135.222
country_id: 1819730
description:
Dec 31 07:18:30 host2 sshd[605760]: Disconnected from invalid user grid 152.32.135.222 port 13242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 31 07:19:00 host2 sshd[606256]: Disconnected from invalid user clouduser 35.210.61.208 port 44440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.222
country_id: 1819730
description:
Dec 31 07:20:20 host2 sshd[607908]: Disconnected from invalid user manager 152.32.135.222 port 54974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Dec 31 07:20:57 host2 sshd[608572]: Disconnected from invalid user clouduser 51.75.253.68 port 54382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 31 07:20:58 host2 sshd[608581]: Disconnected from invalid user otrs 59.97.205.137 port 37736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.246.198.97
country_id: 1861060
description:
Dec 31 07:21:19 host2 sshd[609017]: Disconnected from invalid user ubuntu 43.246.198.97 port 60152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.72
country_id: 1880251
description:
Dec 31 07:20:31 host2 sshd[608103]: Disconnected from invalid user VPN 101.47.143.72 port 43772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.237.143.40
country_id: 798544
description:
Dec 31 07:20:41 host2 sshd[608279]: Disconnected from invalid user samuel 185.237.143.40 port 38298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.194.5
country_id: 3508796
description:
Dec 31 07:20:44 host2 sshd[608345]: Disconnected from invalid user manager 45.169.194.5 port 44186 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 31 07:21:03 host2 sshd[608724]: Disconnected from invalid user ehsan 35.210.61.208 port 43482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.230.136
country_id: 1605651
description:
Dec 31 07:20:37 host2 sshd[608206]: Disconnected from invalid user andres 49.49.230.136 port 49886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.237.143.40
country_id: 798544
description:
Dec 31 07:21:44 host2 sshd[609535]: Disconnected from invalid user fastuser 185.237.143.40 port 53274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.230.136
country_id: 1605651
description:
Dec 31 07:21:55 host2 sshd[609708]: Disconnected from invalid user ubuntu 49.49.230.136 port 42620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.10.36.217
country_id: 1643084
description:
Dec 31 07:23:21 host2 sshd[611241]: Disconnected from invalid user mikey 202.10.36.217 port 46966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Dec 31 07:22:26 host2 sshd[610267]: Disconnected from invalid user tsserver 51.75.253.68 port 34000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 07:22:45 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<bKBpuzVHCq+i8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.253.68
country_id: 3017382
description:
Dec 31 07:22:56 host2 sshd[610804]: Disconnected from invalid user mikey 51.75.253.68 port 35974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Dec 31 07:23:27 host2 sshd[611374]: Disconnected from invalid user user 51.75.253.68 port 33842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.246.198.97
country_id: 1861060
description:
Dec 31 07:23:47 host2 sshd[611724]: Disconnected from invalid user laravel 43.246.198.97 port 47802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 07:23:55 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Nr6YvzVHTJsvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.230.136
country_id: 1605651
description:
Dec 31 07:24:21 host2 sshd[612454]: Disconnected from invalid user github 49.49.230.136 port 36630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.10.36.217
country_id: 1643084
description:
Dec 31 07:24:55 host2 sshd[613072]: Disconnected from invalid user ehsan 202.10.36.217 port 39666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.230.136
country_id: 1605651
description:
Dec 31 07:24:57 host2 sshd[613216]: Disconnected from invalid user bitrix 49.49.230.136 port 53622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 31 07:25:12 host2 sshd[613579]: Disconnected from invalid user dong 104.244.74.84 port 40112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.246.198.97
country_id: 1861060
description:
Dec 31 07:24:23 host2 sshd[612489]: Disconnected from invalid user julius 43.246.198.97 port 56526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.194.5
country_id: 3508796
description:
Dec 31 07:24:25 host2 sshd[612554]: Disconnected from invalid user github 45.169.194.5 port 52372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 31 07:26:00 host2 sshd[614355]: Disconnected from invalid user casaos 104.244.74.84 port 54108 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.246.198.97
country_id: 1861060
description:
Dec 31 07:26:19 host2 sshd[614858]: Disconnected from invalid user ubuntu 43.246.198.97 port 46000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.10.36.217
country_id: 1643084
description:
Dec 31 07:26:21 host2 sshd[614854]: Disconnected from invalid user fastuser 202.10.36.217 port 59806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.151.221
country_id: 3175395
description:
Dec 31 07:25:33 host2 sshd[613948]: Disconnected from invalid user liyang 151.43.151.221 port 54755 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.72
country_id: 1880251
description:
Dec 31 07:26:06 host2 sshd[614461]: Disconnected from invalid user fred 101.47.143.72 port 54570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 31 07:26:11 host2 sshd[614565]: Disconnected from invalid user jacob 52.224.240.74 port 42896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-31 07:27:09 dovecot_login authenticator failed for H=([84.213.189.183]) [84.213.189.183]:36745: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.10.36.217
country_id: 1643084
description:
Dec 31 07:27:20 host2 sshd[616120]: Disconnected from invalid user tsserver 202.10.36.217 port 45642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.246.198.97
country_id: 1861060
description:
Dec 31 07:26:53 host2 sshd[615611]: Disconnected from invalid user anton 43.246.198.97 port 33226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.213
country_id: 1819730
description:
Dec 31 07:27:32 host2 sshd[616422]: Disconnected from invalid user ubuntu 152.32.171.213 port 49034 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-31 07:27:42 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:59244: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 07:29:13 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Qm6G0jVHHtOeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.194.5
country_id: 3508796
description:
Dec 31 07:28:38 host2 sshd[617632]: Disconnected from invalid user bitrix 45.169.194.5 port 55480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 31 07:29:09 host2 sshd[618167]: Disconnected from invalid user vbox 52.224.240.74 port 40696 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.8.147.165
country_id: 6252001
description:
[2025-12-31 07:30:18 +0530] info [cpaneld] 76.8.147.165 - casa18 "GET /login/?login_only=1&user=casa18&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa18 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.65.251.252
country_id: 6252001
description:
[2025-12-31 07:30:20 +0530] info [cpaneld] 73.65.251.252 - casa "GET /login/?login_only=1&user=casa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.130.92.185
country_id: 6252001
description:
[2025-12-31 07:30:21 +0530] info [cpaneld] 70.130.92.185 - cas "GET /login/?login_only=1&user=cas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.60.209.184
country_id: 6252001
description:
[2025-12-31 07:30:11 +0530] info [cpaneld] 68.60.209.184 - casa18villa "GET /login/?login_only=1&user=casa18villa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa18villa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.36.138.91
country_id: 6252001
description:
[2025-12-31 07:30:13 +0530] info [cpaneld] 98.36.138.91 - casa18villacom "GET /login/?login_only=1&user=casa18villacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa18villacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.249.33.78
country_id: 6252001
description:
[2025-12-31 07:30:12 +0530] info [whostmgrd] 73.249.33.78 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.120.127.106
country_id: 6252001
description:
[2025-12-31 07:30:15 +0530] info [cpaneld] 23.120.127.106 - casa18v "GET /login/?login_only=1&user=casa18v&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa18v (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.52.233.213
country_id: 6252001
description:
[2025-12-31 07:30:19 +0530] info [cpaneld] 198.52.233.213 - casa1 "GET /login/?login_only=1&user=casa1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.192.208
country_id: 6252001
description:
[2025-12-31 07:30:10 +0530] info [cpaneld] 67.181.192.208 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.218.4.96
country_id: 6252001
description:
[2025-12-31 07:30:11 +0530] info [cpaneld] 104.218.4.96 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 07:29:37 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Mu740zVHLGei8Jp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.83.54.33
country_id: 6252001
description:
[2025-12-31 07:30:22 +0530] info [cpaneld] 72.83.54.33 - ca "GET /login/?login_only=1&user=ca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.76.69.82
country_id: 6252001
description:
[2025-12-31 07:30:22 +0530] info [cpaneld] 149.76.69.82 - casa18v1 "GET /login/?login_only=1&user=casa18v1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa18v1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.56.116.32
country_id: 6252001
description:
[2025-12-31 07:30:14 +0530] info [cpaneld] 24.56.116.32 - casa18vi "GET /login/?login_only=1&user=casa18vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa18vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.105.179.69
country_id: 6252001
description:
[2025-12-31 07:30:23 +0530] info [cpaneld] 192.105.179.69 - casa18v2 "GET /login/?login_only=1&user=casa18v2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user casa18v2 (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 07:32:08 host2 sshd[621506]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 07:31:28 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<w5uc2jVHUrIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 07:34:17 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<I3+u5DVHcuJo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 07:33:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<MN7f4jVH8s6eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.151.221
country_id: 3175395
description:
Dec 31 07:34:44 host2 sshd[624178]: Disconnected from invalid user test 151.43.151.221 port 54127 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 07:36:14 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ziyk6zVHgzR100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.151.221
country_id: 3175395
description:
Dec 31 07:35:49 host2 sshd[625422]: Disconnected from invalid user under 151.43.151.221 port 54162 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 07:35:53 host2 pure-ftpd[625497]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 07:37:32 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<OlBJ8DVHvL4yBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2025-12-31 07:37:52 dovecot_login authenticator failed for H=(121.242.112.200.static-hyderabad.vsnl.net.in) [121.242.112.200]:55338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.151.221
country_id: 3175395
description:
Dec 31 07:38:01 host2 sshd[627784]: Disconnected from invalid user admini 151.43.151.221 port 54146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-31 07:38:06 dovecot_login authenticator failed for H=([178.232.36.204]) [178.232.36.204]:60658: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.96.229.208
country_id: 6252001
description:
[2025-12-31 07:45:08 +0530] info [cpaneld] 68.96.229.208 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.84.221.6
country_id: 6252001
description:
[2025-12-31 07:45:13 +0530] info [whostmgrd] 135.84.221.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.127.145.242
country_id: 6252001
description:
[2025-12-31 07:45:15 +0530] info [cpaneld] 99.127.145.242 - gnetuniv "GET /login/?login_only=1&user=gnetuniv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.132.11
country_id: 6252001
description:
[2025-12-31 07:45:16 +0530] info [cpaneld] 73.15.132.11 - gnetuni "GET /login/?login_only=1&user=gnetuni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.182.203.219
country_id: 6252001
description:
[2025-12-31 07:45:19 +0530] info [cpaneld] 104.182.203.219 - gnet "GET /login/?login_only=1&user=gnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.51.57.253
country_id: 6252001
description:
[2025-12-31 07:45:18 +0530] info [cpaneld] 174.51.57.253 - gnetu "GET /login/?login_only=1&user=gnetu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.242.253.106
country_id: 6252001
description:
[2025-12-31 07:45:20 +0530] info [cpaneld] 69.242.253.106 - gne "GET /login/?login_only=1&user=gne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.23.131.109
country_id: 6252001
description:
[2025-12-31 07:45:21 +0530] info [cpaneld] 68.23.131.109 - gnetuni1 "GET /login/?login_only=1&user=gnetuni1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.27.37
country_id: 6252001
description:
[2025-12-31 07:45:11 +0530] info [cpaneld] 98.97.27.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.43.196
country_id: 6252001
description:
[2025-12-31 07:45:17 +0530] info [cpaneld] 98.97.43.196 - gnetun "GET /login/?login_only=1&user=gnetun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.127.85
country_id: 6252001
description:
[2025-12-31 07:45:20 +0530] info [cpaneld] 45.31.127.85 - gn "GET /login/?login_only=1&user=gn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.107.191.164
country_id: 6252001
description:
[2025-12-31 07:45:12 +0530] info [cpaneld] 99.107.191.164 - gnetuniversals "GET /login/?login_only=1&user=gnetuniversals&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.255.184.146
country_id: 6252001
description:
[2025-12-31 07:45:14 +0530] info [cpaneld] 73.255.184.146 - gnetuniversalscom "GET /login/?login_only=1&user=gnetuniversalscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversalscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.115.234
country_id: 6252001
description:
[2025-12-31 07:45:22 +0530] info [cpaneld] 172.58.115.234 - gnetuni2 "GET /login/?login_only=1&user=gnetuni2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.231.195.107
country_id: 6252001
description:
[2025-12-31 07:46:37 +0530] info [cpaneld] 73.231.195.107 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.69.161.211
country_id: 6252001
description:
[2025-12-31 07:46:43 +0530] info [whostmgrd] 173.69.161.211 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.65.17.11
country_id: 6252001
description:
[2025-12-31 07:46:45 +0530] info [cpaneld] 99.65.17.11 - maximsh "GET /login/?login_only=1&user=maximsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.146.153
country_id: 6252001
description:
[2025-12-31 07:46:36 +0530] info [cpaneld] 172.59.146.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.109.150.56
country_id: 6252001
description:
[2025-12-31 07:46:43 +0530] info [cpaneld] 143.109.150.56 - maximsholdingscom "GET /login/?login_only=1&user=maximsholdingscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.253.215.165
country_id: 6252001
description:
[2025-12-31 07:46:44 +0530] info [cpaneld] 64.253.215.165 - maximsho "GET /login/?login_only=1&user=maximsho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.22.177.96
country_id: 6252001
description:
[2025-12-31 07:46:54 +0530] info [cpaneld] 70.22.177.96 - maximsh2 "GET /login/?login_only=1&user=maximsh2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.64.93
country_id: 6252001
description:
[2025-12-31 07:46:40 +0530] info [cpaneld] 73.151.64.93 - maximsholdings "GET /login/?login_only=1&user=maximsholdings&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.172.88.229
country_id: 6252001
description:
[2025-12-31 07:46:48 +0530] info [cpaneld] 66.172.88.229 - maxim "GET /login/?login_only=1&user=maxim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maxim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.55.104.66
country_id: 6252001
description:
[2025-12-31 07:46:46 +0530] info [cpaneld] 206.55.104.66 - maxims "GET /login/?login_only=1&user=maxims&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maxims (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.214.249.62
country_id: 6252001
description:
[2025-12-31 07:46:50 +0530] info [cpaneld] 24.214.249.62 - maxi "GET /login/?login_only=1&user=maxi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maxi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.234.86.153
country_id: 6252001
description:
[2025-12-31 07:46:51 +0530] info [cpaneld] 108.234.86.153 - max "GET /login/?login_only=1&user=max&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user max (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.246.182
country_id: 6252001
description:
[2025-12-31 07:46:53 +0530] info [cpaneld] 98.37.246.182 - maximsh1 "GET /login/?login_only=1&user=maximsh1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsh1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.195.162
country_id: 6252001
description:
[2025-12-31 07:46:52 +0530] info [cpaneld] 172.59.195.162 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 07:47:31 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<HW/9EzZH3sCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.208
country_id: 1269750
description:
Dec 31 07:48:00 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=45.118.34.208, lip=66.85.158.91, TLS, session=<lti3FDZHQsUtdiLQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 07:49:08 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<BAzGGTZHbrOeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 07:49:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<l3l/GjZHIwRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.150
country_id: 226074
description:
Dec 31 07:48:22 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.87.150, lip=66.85.158.91, TLS, session=<QIQAFjZHqNDEAFeW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 07:48:37 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=</RryFzZHFIpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.241.244.23
country_id: 1269750
description:
Dec 31 07:52:34 host2 sshd[643713]: Disconnected from invalid user nodejs 150.241.244.23 port 57168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 31 07:53:37 host2 sshd[644762]: Disconnected from invalid user user2 182.93.7.194 port 49490 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.201.190.15
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.201.190.15 - simp "GET /login/?login_only=1&user=simp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.43.90
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.207.43.90 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.13.106.165
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.13.106.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.198.50.19
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 166.198.50.19 - simpuritylk "GET /login/?login_only=1&user=simpuritylk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpuritylk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.23.148.119
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 99.23.148.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.196.237.42
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.196.237.42 - sim "GET /login/?login_only=1&user=sim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.26.82.157
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.26.82.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.241.244.23
country_id: 1269750
description:
Dec 31 07:56:54 host2 sshd[648822]: Disconnected from invalid user hdfs 150.241.244.23 port 53784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2025-12-31 07:56:52 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (chnes) [73.188.252.208]:51400: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.189.83.236
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.189.83.236 - simpurity "GET /login/?login_only=1&user=simpurity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpurity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.87.231
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.87.231 - simpurit "GET /login/?login_only=1&user=simpurit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.7.122.193
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.7.122.193 - simpur "GET /login/?login_only=1&user=simpur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.126.14.101
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.126.14.101 - simpuri "GET /login/?login_only=1&user=simpuri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpuri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.187.191.226
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.187.191.226 - simpu "GET /login/?login_only=1&user=simpu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpu (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.241.244.23
country_id: 1269750
description:
Dec 31 07:57:31 host2 sshd[649432]: Disconnected from invalid user erp 150.241.244.23 port 55850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.241.244.23
country_id: 1269750
description:
Dec 31 07:58:46 host2 sshd[650567]: Disconnected from invalid user dave 150.241.244.23 port 58622 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.178.68
country_id: 1643084
description:
Dec 31 07:59:21 host2 sshd[651456]: Disconnected from invalid user raaj 103.193.178.68 port 60020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Dec 31 07:58:29 host2 sshd[650303]: Disconnected from invalid user myuser 182.93.7.194 port 57528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.68
country_id: 1643084
description:
Dec 31 07:58:35 host2 sshd[650374]: Disconnected from invalid user myuser 103.193.178.68 port 49452 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.237
country_id: 6252001
description:
Dec 31 08:00:55 host2 dovecot[1566]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.237, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oMEERDZHgNaTuYTt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.236.229.1
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 162.236.229.1 - weeratra "GET /login/?login_only=1&user=weeratra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.88.172.202
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 138.88.172.202 - weer "GET /login/?login_only=1&user=weer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.60.55.248
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.60.55.248 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.109.150.79
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 143.109.150.79 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.45.112.178
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.45.112.178 - weerat "GET /login/?login_only=1&user=weerat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weerat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.131.14
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.131.14 - wee "GET /login/?login_only=1&user=wee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.253.134
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.253.134 - weeratr2 "GET /login/?login_only=1&user=weeratr2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratr2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.130.33
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.59.130.33 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.216.150.45
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.216.150.45 - weera "GET /login/?login_only=1&user=weera&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weera (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.140.156.94
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.140.156.94 - weeratr1 "GET /login/?login_only=1&user=weeratr1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratr1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.182.127.211
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.182.127.211 - weeratrading "GET /login/?login_only=1&user=weeratrading&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratrading (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.175.155.96
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.175.155.96 - weeratradingcom "GET /login/?login_only=1&user=weeratradingcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratradingcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.135.66.35
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.135.66.35 - weeratr "GET /login/?login_only=1&user=weeratr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user weeratr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.97.189.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 152.97.189.164 - we "GET /login/?login_only=1&user=we&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user we (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 08:02:54 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<9+0ASzZHkLUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 08:03:15 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<KehATDZHlKtCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 08:02:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<8d7XSjZHROBnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 08:05:09 host2 sshd[657940]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 08:05:00 host2 sshd[657622]: Disconnected from invalid user admin 2.57.121.112 port 47144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 08:05:58 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1cf2VTZH0MOYNcU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.92.237.232
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.92.237.232 - manahar "GET /login/?login_only=1&user=manahar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.225.77.105
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.225.77.105 - manahara "GET /login/?login_only=1&user=manahara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.146.152.63
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.146.152.63 - manaharasupercenter "GET /login/?login_only=1&user=manaharasupercenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.170.198.78
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 148.170.198.78 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.252.160
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 129.222.252.160 - manaharasupercenterlk "GET /login/?login_only=1&user=manaharasupercenterlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercenterlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.161.6.169
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 147.161.6.169 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.109.23
country_id: 1512440
description:
2025-12-31 08:06:23 dovecot_login authenticator failed for H=([213.230.109.23]) [213.230.109.23]:53901: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2025-12-31 08:06:38 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:52575: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.9.92.151
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.9.92.151 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.1.127
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 129.222.1.127 - man "GET /login/?login_only=1&user=man&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user man (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.240.134.19
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.240.134.19 - manahar1 "GET /login/?login_only=1&user=manahar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.76.57.228
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.76.57.228 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.244.121.151
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.244.121.151 - manahar2 "GET /login/?login_only=1&user=manahar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.125.108
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.44.125.108 - manaha "GET /login/?login_only=1&user=manaha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.210.129.209
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.210.129.209 - mana "GET /login/?login_only=1&user=mana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.185.30.83
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.185.30.83 - manah "GET /login/?login_only=1&user=manah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manah (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 08:08:23 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<h6ukXjZHAtczTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.103.212
country_id: 1605651
description:
Dec 31 08:10:00 host2 sshd[663276]: Disconnected from invalid user amir 147.50.103.212 port 53458 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 08:15:34 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<mdVJeDZHsJIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 08:16:38 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<UAohfDZHVJ6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.224
country_id: 3469034
description:
Dec 31 08:18:34 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.189.201.224, lip=66.85.158.91, TLS, session=<hz0HgjZHg9qzvcng>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.223.31
country_id: 798544
description:
Dec 31 08:18:52 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=213.92.223.31, lip=66.85.158.91, TLS, session=<t4M8gzZHz5DVXN8f>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.103.212
country_id: 1605651
description:
Dec 31 08:21:03 host2 sshd[675116]: Disconnected from invalid user postgres 147.50.103.212 port 34950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 08:25:39 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Uz9anDZHvrov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 08:27:59 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<cHC7pDZHLO6eRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 08:28:47 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<WJSSpzZHEnei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 08:31:15 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<V2FqsDZH2kIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 08:32:32 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<yVfztDZHgJh100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-31 08:35:06 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:59279: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-31 08:35:22 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:37072: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 08:38:19 host2 pure-ftpd[692579]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 08:39:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4HyCzzZHzpwvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 08:40:09 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cqI70DZHCiRo7MS0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.135.131.12
country_id: 3017382
description:
[2025-12-31 08:41:43 +0530] info [cpaneld] 147.135.131.12 - fhb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fhb (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.234.153.74
country_id: 6252001
description:
2025-12-31 08:42:32 dovecot_login authenticator failed for H=([50.234.153.74]) [50.234.153.74]:44430: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-31 08:43:09 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:54434: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 08:43:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dRbU3TZHRC5niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-31 08:45:06 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:59984: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 08:45:27 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tv8z4zZH3r9n9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 31 08:45:50 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<OEiq5DZHHL8s3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.163.238
country_id: 953987
description:
2025-12-31 08:45:24 dovecot_login authenticator failed for H=([102.32.163.238]) [102.32.163.238]:35315: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 08:46:24 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<w4WS5jZH7rieRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-31 08:50:24 dovecot_plain authenticator failed for H=(posse) [65.20.184.80]:39388: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 08:50:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<FZMG9jZHhJAyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 31 08:53:17 host2 dovecot[1566]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=<4Z1M/zZHer4s3lFz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.60.62.17
country_id: 6252001
description:
[2025-12-31 09:00:06 +0530] info [cpaneld] 139.60.62.17 - drag "GET /login/?login_only=1&user=drag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drag (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-31 08:59:26 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (mucops) [73.197.194.98]:39780: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.32.12
country_id: 6252001
description:
[2025-12-31 08:59:58 +0530] info [cpaneld] 172.56.32.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.3.165.76
country_id: 6252001
description:
[2025-12-31 08:59:59 +0530] info [cpaneld] 108.3.165.76 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.62.178.228
country_id: 6252001
description:
[2025-12-31 09:00:04 +0530] info [cpaneld] 104.62.178.228 - drago "GET /login/?login_only=1&user=drago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.70.13.243
country_id: 6252001
description:
[2025-12-31 09:00:02 +0530] info [whostmgrd] 173.70.13.243 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.50.212.162
country_id: 6252001
description:
[2025-12-31 09:00:00 +0530] info [cpaneld] 104.50.212.162 - dragon "GET /login/?login_only=1&user=dragon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.230.78.91
country_id: 6252001
description:
[2025-12-31 09:00:03 +0530] info [cpaneld] 108.230.78.91 - dragonlk "GET /login/?login_only=1&user=dragonlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dragonlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.120.11.125
country_id: 6252001
description:
[2025-12-31 09:00:07 +0530] info [cpaneld] 23.120.11.125 - dra "GET /login/?login_only=1&user=dra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.38.38
country_id: 6252001
description:
[2025-12-31 09:00:09 +0530] info [cpaneld] 98.97.38.38 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.18
country_id: 2328926
description:
Dec 31 09:00:15 host2 pure-ftpd[717692]: (?@102.204.223.18) [INFO] New connection from 102.204.223.18


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 09:02:19 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<XkyCHzdHsKRnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-31 09:03:53 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:47126: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2025-12-31 09:04:12 dovecot_login authenticator failed for H=([182.78.209.116]) [182.78.64.18]:34656: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 09:05:43 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<GF+gKzdH8IqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 09:08:40 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<F8I0NjdHcuRCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-12-31 09:09:54 dovecot_login authenticator failed for H=syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:56845: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 31 09:10:20 host2 dovecot[1566]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<Y2lIPDdHzs4syhQX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 09:10:58 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<64dwPjdH/Mei8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 09:11:33 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JOSHQDdH+tYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2025-12-31 09:13:20 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:42584: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-31 09:13:39 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:41014: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-31 09:13:54 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:47329: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.240.109
country_id: 1880251
description:
Dec 31 09:15:45 host2 sshd[734519]: Disconnected from invalid user user2 152.42.240.109 port 36750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 09:15:52 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<KUHvTzdHTGwjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.73
country_id: 2186224
description:
2025-12-31 09:15:32 dovecot_login authenticator failed for H=([121.73.162.73]) [121.73.162.73]:53600: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Dec 31 09:16:20 host2 sshd[735205]: Disconnected from invalid user user2 213.55.85.202 port 4011 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 09:17:38 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Wi1HVjdH8LozTcpt>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 09:18:18 host2 sshd[737521]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 31 09:19:03 host2 sshd[738226]: Disconnected from invalid user user33 45.78.224.217 port 49322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.73.88
country_id: 2635167
description:
Dec 31 09:20:25 host2 sshd[739713]: Disconnected from invalid user brandon 46.101.73.88 port 40104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.15
country_id: 1643084
description:
Dec 31 09:20:41 host2 sshd[739926]: Disconnected from invalid user naresh 103.172.204.15 port 52092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Dec 31 09:21:06 host2 sshd[740528]: Disconnected from invalid user ubuntu 213.55.85.202 port 4014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.178.177
country_id: 1269750
description:
Dec 31 09:21:12 host2 sshd[740604]: Disconnected from invalid user test123 143.110.178.177 port 36874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2025-12-31 09:21:28 dovecot_login authenticator failed for H=([210.56.28.18]) [210.56.28.18]:42586: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 09:21:21 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<GQWTYzdHFqSeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.240.109
country_id: 1880251
description:
Dec 31 09:21:27 host2 sshd[740832]: Disconnected from invalid user logger 152.42.240.109 port 49772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 31 09:21:09 host2 sshd[740567]: Disconnected from invalid user strapi 197.13.24.157 port 36846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 31 09:22:16 host2 sshd[741730]: Disconnected from invalid user sachin 118.193.38.207 port 49734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Dec 31 09:22:25 host2 sshd[741919]: Disconnected from invalid user ftproot 213.55.85.202 port 4016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 09:22:31 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<IU7EZzdHiLozTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.15
country_id: 1643084
description:
Dec 31 09:22:18 host2 sshd[741781]: Disconnected from invalid user user33 103.172.204.15 port 57558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.240.109
country_id: 1880251
description:
Dec 31 09:23:18 host2 sshd[742916]: Disconnected from invalid user uploader 152.42.240.109 port 51572 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.7.19.137
country_id: 6252001
description:
[2025-12-31 09:23:26 +0530] info [cpaneld] 68.7.19.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.164.193.77
country_id: 6252001
description:
[2025-12-31 09:23:31 +0530] info [cpaneld] 98.164.193.77 - anandaob "GET /login/?login_only=1&user=anandaob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.19.106.225
country_id: 6252001
description:
[2025-12-31 09:23:29 +0530] info [whostmgrd] 149.19.106.225 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.52.122.124
country_id: 6252001
description:
[2025-12-31 09:23:39 +0530] info [cpaneld] 184.52.122.124 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.52.97.190
country_id: 6252001
description:
[2025-12-31 09:23:42 +0530] info [cpaneld] 108.52.97.190 - anandao2 "GET /login/?login_only=1&user=anandao2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.106.254.38
country_id: 6252001
description:
[2025-12-31 09:23:41 +0530] info [cpaneld] 99.106.254.38 - anandao1 "GET /login/?login_only=1&user=anandao1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao1 (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.73.88
country_id: 2635167
description:
Dec 31 09:23:11 host2 sshd[742769]: Disconnected from invalid user ubuntu 46.101.73.88 port 55466 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.246.151
country_id: 6252001
description:
[2025-12-31 09:23:28 +0530] info [cpaneld] 67.188.246.151 - anandaobauae "GET /login/?login_only=1&user=anandaobauae&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauae (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.179.100.224
country_id: 6252001
description:
[2025-12-31 09:23:32 +0530] info [cpaneld] 71.179.100.224 - anandao "GET /login/?login_only=1&user=anandao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.220.141.202
country_id: 6252001
description:
[2025-12-31 09:23:33 +0530] info [cpaneld] 72.220.141.202 - ananda "GET /login/?login_only=1&user=ananda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ananda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.223.225.123
country_id: 6252001
description:
[2025-12-31 09:23:35 +0530] info [cpaneld] 97.223.225.123 - anan "GET /login/?login_only=1&user=anan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.63.66.64
country_id: 6252001
description:
[2025-12-31 09:23:40 +0530] info [cpaneld] 68.63.66.64 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.106.192
country_id: 6252001
description:
[2025-12-31 09:23:27 +0530] info [cpaneld] 108.48.106.192 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.219.191.9
country_id: 6252001
description:
[2025-12-31 09:23:30 +0530] info [cpaneld] 76.219.191.9 - anandaobauaeorg "GET /login/?login_only=1&user=anandaobauaeorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauaeorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.140.157.9
country_id: 6252001
description:
[2025-12-31 09:23:34 +0530] info [cpaneld] 99.140.157.9 - anand "GET /login/?login_only=1&user=anand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anand (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.246.58.66
country_id: 2589581
description:
2025-12-31 09:23:54 dovecot_plain authenticator failed for H=(E43HFC1) [154.246.58.66]:62873: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.178.177
country_id: 1269750
description:
Dec 31 09:24:06 host2 sshd[743753]: Disconnected from invalid user user33 143.110.178.177 port 48602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 31 09:24:19 host2 sshd[743913]: Disconnected from invalid user takeshi 118.193.38.207 port 40720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 31 09:24:29 host2 sshd[744213]: Disconnected from invalid user UBUNTU 197.13.24.157 port 44542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Dec 31 09:25:50 host2 sshd[745892]: Disconnected from invalid user finn 213.55.85.202 port 4021 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 09:26:07 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ptuWdDdH+s8FhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 31 09:26:10 host2 sshd[746352]: Disconnected from invalid user ubuntu 197.13.24.157 port 43842 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 31 09:26:19 host2 sshd[746496]: Disconnected from invalid user desktop 118.193.38.207 port 44382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 09:27:10 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<eBlgeDdH8qqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 09:28:57 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<3rDDfjdHlBOi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-31 09:29:09 dovecot_plain authenticator failed for H=(adian) [80.227.147.94]:33432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 09:29:48 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tebNgTdHFmB100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 31 09:30:50 host2 sshd[751746]: Disconnected from invalid user jonathan 45.78.224.217 port 39518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 09:31:49 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RK76iDdHYrEjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.196.19
country_id: 2542007
description:
2025-12-31 09:31:50 dovecot_login authenticator failed for H=([105.73.196.19]) [105.73.196.19]:59591: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-12-31 09:32:04 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:53604: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 31 09:32:06 host2 sshd[753034]: Disconnected from invalid user dns 45.78.224.217 port 51564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 31 09:32:53 host2 sshd[753936]: Disconnected from invalid user bs 45.138.158.114 port 45272 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.217
country_id: 1880251
description:
Dec 31 09:33:16 host2 sshd[754301]: Disconnected from invalid user naresh 45.78.224.217 port 56904 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 09:34:50 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<4JTCkzdHrqEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 09:36:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<e4gmmDdHLueYNcU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 31 09:36:47 host2 sshd[758038]: Disconnected from invalid user anon 45.138.158.114 port 33738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 31 09:36:11 host2 sshd[757486]: Disconnected from invalid user jamesm 45.138.158.114 port 55530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.56.197.159
country_id: 660013
description:
Dec 31 09:38:34 host2 sshd[759843]: Disconnected from invalid user navid 31.56.197.159 port 45512 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.26
country_id: 2542007
description:
Dec 31 09:40:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.232.26, lip=66.85.158.91, TLS, session=<h0+NpjdHrulftega>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.246.8.154
country_id: 2661886
description:
Dec 31 09:40:04 host2 dovecot[1566]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=46.246.8.154, lip=66.85.158.91, session=<JIajpjdHoKcu9gia>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 09:39:31 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<r+t/pDdHPg5niu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.132
country_id: 3686110
description:
Dec 31 09:40:03 host2 dovecot[1566]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=154.47.16.132, lip=66.85.158.91, session=<b1CNpjdHlumaLxCE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.42.140
country_id: 690791
description:
Dec 31 09:40:03 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.239.42.140, lip=66.85.158.91, session=<1mGRpjdHSLVU7yqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 77.81.142.147
country_id: 3996063
description:
Dec 31 09:40:04 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=77.81.142.147, lip=66.85.158.91, session=<poWfpjdH/IVNUY6T>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 194.116.208.210
country_id: 390903
description:
Dec 31 09:40:04 host2 dovecot[1566]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=194.116.208.210, lip=66.85.158.91, session=<CE2cpjdHmHzCdNDS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.52.66
country_id: 798549
description:
Dec 31 09:40:05 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=143.244.52.66, lip=66.85.158.91, session=<1winpjdHkqeP9DRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.134
country_id: 1819730
description:
Dec 31 09:41:03 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=84.17.56.134, lip=66.85.158.91, TLS, session=<q2QgqjdHUrBUETiG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.152
country_id: 453733
description:
Dec 31 09:41:07 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=165.231.182.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DAZnqjdHbo6l57aY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 09:41:08 host2 pure-ftpd[763707]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.246.8.169
country_id: 2661886
description:
Dec 31 09:40:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=46.246.8.169, lip=66.85.158.91, session=<IeYYpzdHBKwu9gip>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.59.161
country_id: 2264397
description:
Dec 31 09:40:12 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.59.161, lip=66.85.158.91, session=<fhIYpzdHuJaSRjuh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.11
country_id: 3508796
description:
Dec 31 09:40:12 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.32.11, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7JQYpzdHErSt9CAL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.120.10
country_id: 798549
description:
Dec 31 09:41:03 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.120.10, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+DwfqjdHRLBbWngK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.73
country_id: 660013
description:
Dec 31 09:41:07 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.112.19.73, lip=66.85.158.91, TLS, session=<fztnqjdHpKvUcBNJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 77.81.142.132
country_id: 3996063
description:
Dec 31 09:40:12 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=77.81.142.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rSQYpzdHNupNUY6E>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.173
country_id: 1643084
description:
Dec 31 09:41:39 host2 sshd[764359]: Disconnected from invalid user valheim 203.145.34.173 port 37684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 31 09:41:51 host2 sshd[764806]: Disconnected from invalid user docker 181.49.50.6 port 52218 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.155
country_id: 3042058
description:
Dec 31 09:42:03 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.90.122.155, lip=66.85.158.91, TLS, session=<WiyyrTdHMpJbWnqb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.15
country_id: 3508796
description:
Dec 31 09:42:03 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.32.15, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ePyxrTdHyNqt9CAP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.213.34.45
country_id: 298795
description:
Dec 31 09:42:54 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.213.34.45, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1wTAsDdHsrS81SIt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.47.135
country_id: 1522867
description:
Dec 31 09:42:54 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.133.47.135, lip=66.85.158.91, TLS, session=<s/+/sDdHtLQ+hS+H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.29.249
country_id: 3202326
description:
Dec 31 09:42:59 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=154.47.29.249, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LJMJsTdH4raaLx35>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.19.204.181
country_id: 146669
description:
Dec 31 09:42:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=193.19.204.181, lip=66.85.158.91, TLS, session=<wTK3rjdHaELBE8y1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.220
country_id: 3190538
description:
Dec 31 09:42:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=195.80.150.220, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gHy2rjdHCKPDUJbc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.246.8.154
country_id: 2661886
description:
Dec 31 09:42:33 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=46.246.8.154, lip=66.85.158.91, TLS handshaking: Connection closed, session=<60d5rzdH5Msu9gia>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.39
country_id: 458258
description:
Dec 31 09:42:52 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=196.196.53.39, lip=66.85.158.91, TLS handshaking: Connection closed, session=</NmhsDdHorTExDUn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 77.81.142.147
country_id: 3996063
description:
Dec 31 09:43:07 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=77.81.142.147, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vy+KsTdHmu1NUY6T>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.26
country_id: 2542007
description:
Dec 31 09:43:07 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.181.232.26, lip=66.85.158.91, TLS, session=<3i6KsTdHVqhftega>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.15.9
country_id: 1733045
description:
Dec 31 09:43:29 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.15.9, lip=66.85.158.91, TLS, session=<PDDYsjdHlqmSRg8J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.138
country_id: 1814991
description:
Dec 31 09:43:29 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.241.80.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=<my3YsjdHMKy88VCK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 09:43:35 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<CpgaszdH0KBn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.73
country_id: 660013
description:
Dec 31 09:43:55 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=212.112.19.73, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5qFhtDdHrprUcBNJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 31 09:43:55 host2 sshd[767786]: Disconnected from invalid user tempuser 181.49.50.6 port 55226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 31 09:43:11 host2 sshd[766649]: Disconnected from invalid user render 181.49.50.6 port 43442 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.238.180
country_id: 290557
description:
Dec 31 09:45:06 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.238.180, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TvGkuDdHZ2KSRu60>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.138
country_id: 1814991
description:
Dec 31 09:44:22 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.241.80.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mar9tTdH/IS88VCK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.52
country_id: 1831722
description:
Dec 31 09:44:48 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.215.235.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5F6JtzdH2Oy81+s0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.52.66
country_id: 798549
description:
Dec 31 09:44:48 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=143.244.52.66, lip=66.85.158.91, TLS, session=<zjuItzdH5uyP9DRC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 09:45:46 host2 sshd[771410]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.42.140
country_id: 690791
description:
Dec 31 09:45:11 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.239.42.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2uTwuDdHYNtU7yqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.180
country_id: 290557
description:
Dec 31 09:45:17 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=217.138.193.180, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YolIuTdHJoLZisG0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.246.8.154
country_id: 2661886
description:
Dec 31 09:45:31 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=46.246.8.154, lip=66.85.158.91, TLS handshaking: Connection closed, session=</MUcujdHLpcu9gia>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.15.9
country_id: 1733045
description:
Dec 31 09:45:17 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.15.9, lip=66.85.158.91, TLS, session=<atxHuTdHMoKSRg8J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 09:45:51 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<cOAbuzdHMqCeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.101.210.57
country_id: 2077456
description:
Dec 31 09:45:56 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=191.101.210.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+L2VuzdHGIi/ZdI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.59.161
country_id: 2264397
description:
Dec 31 09:46:00 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.59.161, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jL3duzdHyp2SRjuh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.120.10
country_id: 798549
description:
Dec 31 09:45:31 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.90.120.10, lip=66.85.158.91, TLS, session=<s8QcujdHPJdbWngK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.64
country_id: 3895114
description:
Dec 31 09:45:56 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.11.64, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wQeXuzdHiKqSRgtA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.173
country_id: 1643084
description:
Dec 31 09:46:42 host2 sshd[772662]: Disconnected from invalid user render 203.145.34.173 port 36270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.15.9
country_id: 1733045
description:
Dec 31 09:46:44 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.15.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0Oh6vjdHlNKSRg8J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.235.136
country_id: 102358
description:
Dec 31 09:46:55 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=95.181.235.136, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pjQgvzdHLNZfteuI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.160.133
country_id: 174982
description:
Dec 31 09:46:32 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.253.160.133, lip=66.85.158.91, TLS, session=<uvC4vTdH8LG5/aCF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.15
country_id: 3508796
description:
Dec 31 09:46:32 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.32.15, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+2G4vTdH7LGt9CAP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.64
country_id: 3895114
description:
Dec 31 09:46:36 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.11.64, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9174vTdHsp6SRgtA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.11
country_id: 3508796
description:
Dec 31 09:46:36 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.244.32.11, lip=66.85.158.91, TLS, session=<bT34vTdHtJ6t9CAL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 77.81.142.150
country_id: 3996063
description:
Dec 31 09:46:55 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=77.81.142.150, lip=66.85.158.91, TLS, session=<DzkevzdHMtZNUY6W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 09:46:20 host2 dovecot[1566]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<xM/ovDdHXt1o7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.132
country_id: 3686110
description:
Dec 31 09:46:44 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.47.16.132, lip=66.85.158.91, TLS, session=<oaV6vjdH5t+aLxCE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.59.161
country_id: 2264397
description:
Dec 31 09:47:40 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.59.161, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7NLRwTdHst2SRjuh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.196.53.39
country_id: 458258
description:
Dec 31 09:47:44 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=196.196.53.39, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PXwIwjdHcujExDUn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.64
country_id: 3895114
description:
Dec 31 09:47:44 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.11.64, lip=66.85.158.91, TLS, session=<32gIwjdHeuiSRgtA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 77.81.142.147
country_id: 3996063
description:
Dec 31 09:47:38 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=77.81.142.147, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GRC1wTdHiJBNUY6T>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.22
country_id: 3439705
description:
Dec 31 09:47:38 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.84.102.22, lip=66.85.158.91, TLS, session=<y+a0wTdHTKUtVGYW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.246.8.154
country_id: 2661886
description:
Dec 31 09:47:40 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.246.8.154, lip=66.85.158.91, TLS, session=<a+zLwTdH8qEu9gia>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.52.66
country_id: 798549
description:
Dec 31 09:47:40 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=143.244.52.66, lip=66.85.158.91, TLS, session=<YmLSwTdHwN2P9DRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.47.135
country_id: 1522867
description:
Dec 31 09:47:46 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.133.47.135, lip=66.85.158.91, TLS, session=<h+8kwjdHdJg+hS+H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.155
country_id: 3042058
description:
Dec 31 09:47:46 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.122.155, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2oUkwjdHoq5bWnqb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-31 09:47:58 dovecot_login authenticator failed for H=([125.20.249.154]) [103.251.31.154]:34492: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.111.54
country_id: 6252001
description:
Dec 31 09:47:18 host2 sshd[773749]: Disconnected from invalid user felix 137.184.111.54 port 37454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-31 09:47:29 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:56445: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.73
country_id: 660013
description:
Dec 31 09:47:46 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.112.19.73, lip=66.85.158.91, TLS, session=<o1AlwjdHVOTUcBNJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.152
country_id: 453733
description:
Dec 31 09:47:40 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=165.231.182.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MvrLwTdHnMel57aY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.111.54
country_id: 6252001
description:
Dec 31 09:47:46 host2 sshd[774385]: Disconnected from invalid user ubuntu 137.184.111.54 port 59538 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.19.204.181
country_id: 146669
description:
Dec 31 09:48:32 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=193.19.204.181, lip=66.85.158.91, TLS, session=<Og7oxDdH6NzBE8y1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.64
country_id: 3895114
description:
Dec 31 09:48:51 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.11.64, lip=66.85.158.91, TLS, session=<aHgJxjdHatOSRgtA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.42.140
country_id: 690791
description:
Dec 31 09:48:30 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.239.42.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I4rNxDdHXJVU7yqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.101.210.57
country_id: 2077456
description:
Dec 31 09:48:32 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=191.101.210.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<t7rpxDdHire/ZdI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.138
country_id: 1814991
description:
Dec 31 09:48:51 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.241.80.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=<It0KxjdHYNO88VCK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.173
country_id: 1643084
description:
Dec 31 09:48:57 host2 sshd[776486]: Disconnected from invalid user tempuser 203.145.34.173 port 37794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.111.54
country_id: 6252001
description:
Dec 31 09:48:15 host2 sshd[775445]: Disconnected from invalid user system 137.184.111.54 port 38096 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.42.140
country_id: 690791
description:
Dec 31 09:49:20 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=84.239.42.140, lip=66.85.158.91, TLS, session=<RirDxzdHWsFU7yqM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.52
country_id: 1831722
description:
Dec 31 09:49:56 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.215.235.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=<T2rhyTdH/ua81+s0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.137
country_id: 1210997
description:
Dec 31 09:49:10 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.159.40.137, lip=66.85.158.91, TLS, session=<S3wsxzdH5pxinyiJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.120.10
country_id: 798549
description:
Dec 31 09:49:10 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.90.120.10, lip=66.85.158.91, TLS, session=<qw0vxzdHxMlbWngK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.220
country_id: 3190538
description:
Dec 31 09:49:10 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=195.80.150.220, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z/YuxzdHusnDUJbc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.73
country_id: 660013
description:
Dec 31 09:49:37 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=212.112.19.73, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0sLHyDdHVuPUcBNJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.22
country_id: 597427
description:
Dec 31 09:49:39 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 7 secs): user=<>, rip=45.132.194.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4TDkyDdHUOMthMIW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.40
country_id: 1831722
description:
Dec 31 09:49:10 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.215.235.40, lip=66.85.158.91, TLS handshaking: Connection closed, session=<puIsxzdH4Jy81+so>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2025-12-31 09:50:20 dovecot_login authenticator failed for H=([49.124.148.192]) [49.124.148.192]:49176: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.173.62
country_id: 2921044
description:
Dec 31 09:50:37 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.173.62, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KghczDdHuLe11q0+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.52.66
country_id: 798549
description:
Dec 31 09:50:54 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=143.244.52.66, lip=66.85.158.91, TLS, session=<bENizTdHBImP9DRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.73
country_id: 660013
description:
Dec 31 09:50:37 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.112.19.73, lip=66.85.158.91, TLS, session=<MZRczDdHuOXUcBNJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.47.37.18
country_id: 6252001
description:
2025-12-31 09:50:41 dovecot_login authenticator failed for H=([50.47.37.18]) [50.47.37.18]:47321: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.137
country_id: 1210997
description:
Dec 31 09:50:45 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=98.159.40.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qvjXzDdHIr5inyiJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.235.136
country_id: 102358
description:
Dec 31 09:50:54 host2 dovecot[1566]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.235.136, lip=66.85.158.91, TLS handshaking: Connection closed, session=<K9xjzTdH+ohfteuI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 09:51:23 host2 sshd[780272]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.15
country_id: 3508796
description:
Dec 31 09:51:57 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.244.32.15, lip=66.85.158.91, TLS, session=<zSEf0TdHzsOt9CAP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 77.81.142.150
country_id: 3996063
description:
Dec 31 09:51:49 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=77.81.142.150, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YCOj0DdHsspNUY6W>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.176.86.41
country_id: 2921044
description:
Dec 31 09:51:57 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=193.176.86.41, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NG4f0TdHgqbBsFYp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.22
country_id: 597427
description:
Dec 31 09:52:08 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.132.194.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nRTE0TdHHNcthMIW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.188
country_id: 6252001
description:
Dec 31 09:52:41 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.188, lip=66.85.158.92, TLS, session=<sRS70zdHON8UQcK8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.173
country_id: 1643084
description:
Dec 31 09:53:18 host2 sshd[782672]: Disconnected from invalid user administrador 203.145.34.173 port 58286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.145.34.173
country_id: 1643084
description:
Dec 31 09:53:58 host2 sshd[783342]: Disconnected from invalid user felix 203.145.34.173 port 45172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.56.125
country_id: 6252001
description:
Dec 31 09:54:06 host2 dovecot[779926]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.56.125, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<NXDL2DdHTsYUajh9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.206
country_id: 6252001
description:
Dec 31 09:56:12 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.132.206, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JDJT4DdHO9mTuYTO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.206
country_id: 6252001
description:
Dec 31 09:57:08 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.132.206, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<bV6i4zdHlOWTuYTO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 09:57:47 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<S4bW5TdHaqEvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.192
country_id: 6252001
description:
Dec 31 10:00:04 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=162.216.149.192, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Bskr7jdHocOi2JXA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 31 10:00:07 host2 dovecot[779926]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<5uda7jdHItgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.192
country_id: 6252001
description:
Dec 31 10:02:07 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 28 secs): user=<>, rip=162.216.149.192, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MGR39TdHtuui2JXA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-31 10:01:35 dovecot_login authenticator failed for H=([90.160.139.163]) [90.160.139.163]:59021: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-12-31 10:01:51 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:54721: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 10:01:52 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fyZ59DdHet5nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.192
country_id: 6252001
description:
Dec 31 10:02:13 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.149.192, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<UavU9TdH3Pai2JXA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.192
country_id: 6252001
description:
Dec 31 10:03:48 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.192, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<0y17+zdHJOii2JXA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.206
country_id: 6252001
description:
Dec 31 10:03:45 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.206, lip=66.85.158.91, TLS, session=<supM+zdHRuWTuYTO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 10:05:23 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<wrAQAThHIJ0yBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 31 10:05:30 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<0T+OAThHooIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 31 10:05:44 host2 dovecot[779926]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ez9xAjhHOqsDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 10:06:09 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ZHTHAzhH/p6i8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.18
country_id: 6252001
description:
Dec 31 10:08:08 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.18, lip=66.85.158.92, session=<Oh8ACzhHoOnN0h8S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.192
country_id: 6252001
description:
Dec 31 10:09:31 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.192, lip=66.85.158.92, TLS, session=<yZDuDzhHUO2i2JXA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 10:10:53 host2 sshd[804116]: Disconnected from invalid user admin 2.57.121.112 port 36605 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.192
country_id: 6252001
description:
Dec 31 10:10:54 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.192, lip=66.85.158.92, TLS, session=<pu3jFDhHiOyi2JXA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 10:15:11 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<8RcSJDhHiopCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 10:16:45 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<WlWqKThHIqcjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 31 10:18:05 host2 sshd[812980]: Disconnected from invalid user alex 58.98.199.45 port 55579 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 10:21:21 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<q9wnOjhHuNUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 10:22:13 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<cg1APThHVYx100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.237.248
country_id: 6252001
description:
Dec 31 10:26:26 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.234.237.248, lip=66.85.158.91, session=<0MBsTDhHkOKs6u34>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 10:27:07 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<e7TETjhHWOCeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.17
country_id: 798549
description:
Dec 31 10:27:39 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.17, lip=66.85.158.92, session=<APPOUDhHuuZV2YwR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 31 10:27:10 host2 sshd[823566]: Disconnected from invalid user test001 58.98.199.45 port 42278 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:27:16 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<MVprTzhHzKkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.237.248
country_id: 6252001
description:
Dec 31 10:27:21 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.234.237.248, lip=66.85.158.91, session=<q0SxTzhHeEes6u34>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 31 10:28:55 host2 dovecot[779926]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<tK1QVThHs/7CpRCj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 10:28:21 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Q+cxUzhHYpUzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:28:34 host2 dovecot[779926]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<64QXVDhHZtADgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 31 10:28:36 host2 sshd[825149]: Disconnected from invalid user ubuntu 58.98.199.45 port 38346 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:29:09 host2 dovecot[779926]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<bXklVjhHoo4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-31 10:29:35 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:53756: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-31 10:29:46 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:57470: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 10:29:51 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57844: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 10:30:25 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<U6WSWjhHhnei8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 31 10:30:37 host2 dovecot[779926]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<XR5pWzhHeOMDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 31 10:31:28 host2 sshd[828922]: Disconnected from invalid user bitrix 58.98.199.45 port 56599 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.109
country_id: 6252001
description:
Dec 31 10:31:58 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.109, lip=66.85.158.92, session=<LSk5YDhHn6NAPsVt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec 31 10:32:10 host2 dovecot[779926]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.92, TLS: Connection closed, session=<VnH1YDhHSoRAPsVr>


