# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.17
country_id: 3175395
description:
Dec 23 06:22:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=195.177.113.17, lip=66.85.158.91, TLS, session=</u4A9JNGQoTDsXER>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 06:22:36 host2 pure-ftpd[263931]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.251
country_id: 732800
description:
Dec 23 06:22:43 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.255.212.251, lip=66.85.158.91, TLS, session=<WjYd9ZNG+9q5/9T7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 06:24:00 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:45610: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 06:25:27 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:49764: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 06:26:24 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<aZwiA5RGgsPBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2025-12-23 06:27:47 dovecot_login authenticator failed for H=([127.0.0.1]) [109.237.113.106]:54094: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-23 06:28:05 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.185.170]:32942: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 06:33:10 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:58130: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 06:33:18 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:43978: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-23 06:33:48 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:54668: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-23 06:34:03 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:59025: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-23 06:35:09 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:49691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-23 06:35:26 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:46567: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 06:37:12 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:59138: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 06:37:18 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:58624: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-12-23 06:39:27 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:58072: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-23 06:39:42 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:4036: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-23 06:39:58 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:24086: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-23 06:40:04 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:60164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.13
country_id: 1733045
description:
2025-12-23 06:40:23 dovecot_login authenticator failed for H=([49.124.153.13]) [49.124.153.13]:37098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 06:40:50 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:45643: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-23 06:41:12 dovecot_login authenticator failed for H=([152.52.246.198]) [152.52.246.198]:55236: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-23 06:41:34 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:36212: 535 Incorrect authentication data (set_id=awanish)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.91.124.142
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.91.124.142: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2025-12-23 06:46:59 dovecot_login authenticator failed for H=([127.0.0.1]) [24.232.114.16]:43807: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.7.17
country_id: 3144096
description:
2025-12-23 06:47:33 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.7.17]:55291: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 23 06:49:05 host2 sshd[289683]: Disconnected from invalid user kocom 194.87.187.47 port 34888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 23 06:50:11 host2 sshd[290843]: Disconnected from invalid user testuser 194.87.187.47 port 48142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 06:50:33 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:38848: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 06:53:03 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:13978: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 06:54:09 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:54926: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.205.186.84
country_id: 146669
description:
[2025-12-23 06:55:54 +0530] info [webmaild] 185.205.186.84 - isuru@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.220
country_id: 6252001
description:
Dec 23 06:58:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.220, lip=66.85.158.92, TLS, session=<BL5SdpRGrPrN0h/c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 06:58:44 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:45622: 535 Incorrect authentication data (set_id=sales@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 06:59:02 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:57622: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:00:17 host2 sshd[303569]: Disconnected from invalid user user 154.124.97.102 port 59599 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 23 07:02:36 host2 sshd[306423]: Disconnected from invalid user admin 103.144.247.233 port 34230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 23 07:03:12 host2 sshd[307300]: Disconnected from invalid user test 103.144.247.233 port 46336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 07:04:55 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:48814: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:04:21 host2 sshd[308512]: Disconnected from invalid user steam 154.124.97.102 port 35893 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.206.139
country_id: 6252001
description:
Dec 23 07:04:38 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.206.139, lip=66.85.158.92, session=<PakGjJRGIoqlms6L>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.206.139
country_id: 6252001
description:
Dec 23 07:04:39 host2 dovecot[3805015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.206.139, lip=66.85.158.92, session=<ghUXjJRGsoqlms6L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 07:04:45 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:44236: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-23 07:06:03 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:55838: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:05:26 host2 sshd[310145]: Disconnected from invalid user admin 154.124.97.102 port 57326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.146
country_id: 3996063
description:
2025-12-23 07:06:17 dovecot_login authenticator failed for H=(187.161.222.146-clientes-izzi.mx) [187.161.222.146]:55540: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:06:34 host2 sshd[311558]: Disconnected from invalid user ftpuser 154.124.97.102 port 56246 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 23 07:08:56 host2 pure-ftpd[314663]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-23 07:08:56 dovecot_login authenticator failed for H=([84.211.10.125]) [84.211.10.125]:55247: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 23 07:09:00 host2 pure-ftpd[314765]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 07:08:31 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:55934: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.38
country_id: 3996063
description:
2025-12-23 07:08:42 dovecot_login authenticator failed for H=(187.161.136.38-clientes-izzi.mx) [187.161.136.38]:43247: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.64
country_id: 1880251
description:
Dec 23 07:09:12 host2 sshd[314983]: Disconnected from invalid user admin 45.78.223.64 port 48256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.164.1.102
country_id: 1605651
description:
2025-12-23 07:11:41 dovecot_plain authenticator failed for H=(localhost) [43.164.1.102]:44950: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 07:12:30 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:34158: 535 Incorrect authentication data (set_id=office@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.112.96
country_id: 6252001
description:
Dec 23 07:15:14 host2 pure-ftpd[323177]: (?@135.119.112.96) [INFO] New connection from 135.119.112.96


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.193.44.203
country_id: 1819730
description:
Dec 23 07:15:33 host2 pure-ftpd[323591]: (?@118.193.44.203) [INFO] New connection from 118.193.44.203


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.64
country_id: 1880251
description:
Dec 23 07:15:43 host2 sshd[323602]: Disconnected from invalid user salim 45.78.223.64 port 45798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-23 07:17:01 dovecot_login authenticator failed for H=(200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:40756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.26
country_id: 3865483
description:
Dec 23 07:17:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.252.26, lip=66.85.158.91, TLS, session=<SxB5t5RG6d2zAPwa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.90
country_id: 298795
description:
Dec 23 07:17:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=95.0.32.90, lip=66.85.158.91, TLS, session=<x2cOuZRGsY5fACBa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 07:18:04 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:53626: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 07:19:12 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:45812: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 07:19:20 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:52168: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Dec 23 07:20:57 host2 sshd[329990]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 62799


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.157
country_id: 3996063
description:
2025-12-23 07:21:56 dovecot_login authenticator failed for H=(187.161.222.157-clientes-izzi.mx) [187.161.222.157]:42257: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.75.132
country_id: 3469034
description:
Dec 23 07:21:54 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=177.190.75.132, lip=66.85.158.91, TLS, session=<W0GcyJRGQ+2xvkuE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-23 07:22:07 dovecot_login authenticator failed for H=(187.161.136.18-clientes-izzi.mx) [187.161.136.18]:50266: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.223
country_id: 3865483
description:
Dec 23 07:21:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.250.223, lip=66.85.158.91, TLS, session=<YbBVx5RGSZazAPrf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-12-23 07:23:10 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:53802: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-23 07:22:26 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:42664: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 07:23:36 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:18284: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 07:25:08 host2 pure-ftpd[333956]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 07:25:17 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:23330: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 07:26:40 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:58970: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-12-23 07:27:43 dovecot_login authenticator failed for H=(cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:44550: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-23 07:29:02 dovecot_login authenticator failed for H=(dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:46702: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-23 07:28:20 dovecot_login authenticator failed for H=([27.123.113.10]) [27.123.113.10]:39234: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.94
country_id: 2542007
description:
2025-12-23 07:28:41 dovecot_login authenticator failed for H=([105.73.190.94]) [105.73.190.94]:41750: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-23 07:29:20 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:38190: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-23 07:29:42 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:39885: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Dec 23 07:29:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2q2R5pRGTnBBMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Dec 23 07:30:14 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=</uSY55RGcMZBMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Dec 23 07:32:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.59, lip=66.85.158.91, TLS: Connection closed, session=</McP8JRG1v2nXpI7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 23 07:34:05 host2 sshd[343096]: Disconnected from invalid user emma 51.178.141.222 port 44902 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.198.163.6
country_id: 241170
description:
Dec 23 07:34:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.198.163.6, lip=66.85.158.92, session=<vrU295RGYJ2axqMG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.198.163.6
country_id: 241170
description:
Dec 23 07:36:06 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=154.198.163.6, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1xaI/JRGaNSaxqMG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 23 07:35:15 host2 sshd[344303]: Disconnected from invalid user infra 51.178.141.222 port 44634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-23 07:36:16 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:34218: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 07:36:22 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:41776: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.251
country_id: 2635167
description:
Dec 23 07:36:37 host2 dovecot[3805015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.251, lip=66.85.158.91, TLS, session=<cFBq/pRGGeVX7LD7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.162
country_id: 2635167
description:
Dec 23 07:36:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.162, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NTx9/pRG74BX7LCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-23 07:36:41 dovecot_login authenticator failed for H=([182.95.181.166]) [182.95.181.166]:45262: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.232
country_id: 2658434
description:
Dec 23 07:37:14 host2 sshd[345937]: Disconnected from invalid user jorge 185.196.11.232 port 35228 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.153
country_id: 2635167
description:
Dec 23 07:37:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.153, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ovx5AJVGmeNX7LCZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-12-23 07:37:16 dovecot_login authenticator failed for H=([195.222.59.157]) [195.222.59.157]:47750: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.11
country_id: 1733045
description:
2025-12-23 07:37:35 dovecot_login authenticator failed for H=([49.124.151.11]) [49.124.151.11]:52610: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.148
country_id: 2635167
description:
Dec 23 07:37:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.148, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<v+91ApVGdexX7LCU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 07:37:59 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:60872: 535 Incorrect authentication data (set_id=help@seyawin.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.168
country_id: 2635167
description:
Dec 23 07:38:18 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.168, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BKByBJVG64hX7LCo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.166
country_id: 2635167
description:
Dec 23 07:38:52 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.166, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<qyNvBpVGA6C594mm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.157
country_id: 2635167
description:
Dec 23 07:39:59 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SHFsCpVGlZS594md>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.156
country_id: 2635167
description:
Dec 23 07:39:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</5toCJVGNce594mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.159
country_id: 2635167
description:
Dec 23 07:41:05 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.159, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<289dDpVGO89X7LCf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.180
country_id: 2635167
description:
Dec 23 07:40:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.180, lip=66.85.158.91, TLS handshaking: Connection closed, session=<teRjDJVG0Zu594m0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 07:41:31 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:41790: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.178
country_id: 2635167
description:
Dec 23 07:41:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.178, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<0FhaEJVGk5W594my>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2025-12-23 07:43:13 dovecot_login authenticator failed for H=([49.124.153.35]) [49.124.153.35]:46724: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-23 07:42:17 dovecot_login authenticator failed for H=(cm-84.211.12.159.get.no) [84.211.12.159]:42895: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 23 07:42:21 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=80.82.77.202, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UtrhEpVGYOpQUk3K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-23 07:42:49 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:52734: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-23 07:42:49 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:33297: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.157.142.117
country_id: 1227603
description:
[2025-12-23 07:42:54 +0530] info [cpaneld] 175.157.142.117 - jrdclk "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.157.142.117
country_id: 1227603
description:
[2025-12-23 07:44:30 +0530] info [cpaneld] 175.157.142.117 - jrdclk "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 07:45:14 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:49088: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-23 07:46:03 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:52945: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 07:45:23 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:51288: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.61.131.129
country_id: 2510769
description:
2025-12-23 07:45:41 dovecot_login authenticator failed for H=129.red-83-61-131.dynamicip.rima-tde.net [83.61.131.129]:50899: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 07:48:44 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:49164: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 07:51:47 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:50482: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-23 07:53:18 dovecot_login authenticator failed for H=([185.101.16.250]) [185.101.16.250]:41833: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 07:53:35 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:33358: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-12-23 07:53:47 dovecot_login authenticator failed for H=([200.202.250.46]) [200.202.250.46]:49379: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-23 07:54:38 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:60002: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-23 07:54:59 dovecot_login authenticator failed for H=([200.148.171.233]) [189.56.0.19]:34304: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-12-23 07:54:22 dovecot_login authenticator failed for H=([49.124.151.56]) [49.124.151.56]:47420: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-23 07:54:23 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:41826: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.166.169.197
country_id: 2635167
description:
Dec 23 07:56:38 host2 pure-ftpd[366202]: (?@188.166.169.197) [INFO] New connection from 188.166.169.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 07:56:55 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:49782: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 07:58:39 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:51958: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 07:59:06 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:38298: 535 Incorrect authentication data (set_id=office@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.166.169.197
country_id: 2635167
description:
Dec 23 08:01:47 host2 pure-ftpd[372896]: (?@188.166.169.197) [INFO] New connection from 188.166.169.197


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.39.92.35
country_id: 6252001
description:
[2025-12-23 08:01:53 +0530] info [cpaneld] 68.39.92.35 - dragon "GET / HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.129.146
country_id: 6252001
description:
[2025-12-23 08:02:22 +0530] info [webmaild] 192.111.129.146 - info@sysnytech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 08:04:43 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:50706: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec 23 08:06:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, session=<TAr8aJVGD/4t4/6c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 23 08:07:05 host2 sshd[378993]: Disconnected from invalid user guest 179.33.186.151 port 51658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 23 08:07:57 host2 sshd[379964]: Disconnected from invalid user testuser 179.33.186.151 port 13353 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-23 08:08:44 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:27294: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-23 08:08:55 dovecot_login authenticator failed for H=([177.239.164.55]) [177.239.164.55]:59376: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 23 08:08:36 host2 sshd[380603]: Disconnected from invalid user hadoop 179.33.186.151 port 21016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.192.52
country_id: 1819730
description:
Dec 23 08:09:32 host2 sshd[381487]: Disconnected from invalid user dev 152.32.192.52 port 45346 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.192.52
country_id: 1819730
description:
Dec 23 08:13:06 host2 sshd[385983]: Disconnected from invalid user admin 152.32.192.52 port 47686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-23 08:13:12 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:47689: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-23 08:13:13 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [136.56.34.147]:57124: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 08:13:21 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:43778: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-12-23 08:13:38 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com (145.173.198.203.static.netvigator.com) [203.198.173.137]:33386: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.192.52
country_id: 1819730
description:
Dec 23 08:14:10 host2 sshd[386833]: Disconnected from invalid user hadoop 152.32.192.52 port 39106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-23 08:14:36 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:35351: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-23 08:15:03 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:53404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.102
country_id: 690791
description:
Dec 23 08:16:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=176.103.1.102, lip=66.85.158.91, TLS, session=<vlO8ipVGf+mwZwFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-23 08:15:20 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:38014: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.29
country_id: 3175395
description:
Dec 23 08:16:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.29, lip=66.85.158.91, TLS, session=<q//Ti5VGaY65xQkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-12-23 08:17:39 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:60958: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.7
country_id: 1733045
description:
2025-12-23 08:18:17 dovecot_login authenticator failed for H=([49.124.151.7]) [49.124.151.7]:44122: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-23 08:21:03 dovecot_login authenticator failed for H=([84.211.10.140]) [84.211.10.140]:48596: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.75.122
country_id: 690791
description:
Dec 23 08:21:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=194.44.75.122, lip=66.85.158.91, TLS, session=<2wZVnJVGmL/CLEt6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-23 08:20:40 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:49380: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 08:20:40 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:4619: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.188
country_id: 2510769
description:
Dec 23 08:20:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=139.28.190.188, lip=66.85.158.91, TLS, session=<5uJHm5VGZ7mLHL68>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-23 08:21:43 dovecot_login authenticator failed for H=host-89-242-182-159.as13285.net [89.242.182.159]:37665: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.62.120.151
country_id: 2635167
description:
Dec 23 08:23:00 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.62.120.151, lip=66.85.158.91, session=<AT5CpJVGpuGyPniX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 08:23:24 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:44610: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.14.195.218
country_id: 2510769
description:
2025-12-23 08:25:57 dovecot_login authenticator failed for H=218.red-88-14-195.dynamicip.rima-tde.net [88.14.195.218]:37836: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-23 08:26:13 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:46414: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2025-12-23 08:27:31 dovecot_login authenticator failed for H=([182.95.178.174]) [182.95.178.174]:40442: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 08:27:57 host2 pure-ftpd[398041]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 08:28:26 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:55258: 535 Incorrect authentication data (set_id=sales@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 08:29:06 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:60756: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.62.120.151
country_id: 2635167
description:
Dec 23 08:29:17 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=178.62.120.151, lip=66.85.158.91, session=<H5nFupVGMp2yPniX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Dec 23 08:30:00 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<RmExvZVG6LPE+2YO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.235.242
country_id: 1269750
description:
2025-12-23 08:31:35 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [115.244.235.242]:39104: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.196
country_id: 3996063
description:
2025-12-23 08:32:05 dovecot_login authenticator failed for H=(201.173.216.196-clientes-izzi.mx) [201.173.216.196]:51188: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-23 08:31:19 dovecot_login authenticator failed for H=(static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:51946: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-23 08:32:27 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:52860: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.252.34
country_id: 2635167
description:
Dec 23 08:33:39 host2 pure-ftpd[402952]: (?@165.154.252.34) [INFO] New connection from 165.154.252.34


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 08:34:13 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:59960: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 23 08:33:21 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jjZJyZVG5lBChJmM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 08:34:19 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:11598: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.195
country_id: 6252001
description:
Dec 23 08:35:15 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.195, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zysc0JVGDsiTuYTD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 08:38:04 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:58718: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 23 08:39:03 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.214, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zBGz3ZVGGt4jy9LW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 23 08:39:45 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.214, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<uXgo4JVGOPEjy9LW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 08:41:07 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:51268: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 08:40:50 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:42782: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 08:41:15 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:33782: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.5
country_id: 798549
description:
Dec 23 08:44:37 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.5, lip=66.85.158.91, session=<4ryZ8ZVGBolV2YwF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.180
country_id: 6252001
description:
Dec 23 08:44:53 host2 pure-ftpd[415135]: (?@147.185.132.180) [INFO] New connection from 147.185.132.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 08:46:13 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:44248: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 08:46:43 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:49220: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 23 08:47:09 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.214, lip=66.85.158.91, TLS, session=<Wfmg+pVGsPEjy9LW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 08:46:21 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:60886: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 08:50:22 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:51522: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 08:53:08 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59182: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.193
country_id: 2635167
description:
Dec 23 08:53:32 host2 dovecot[3805015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.193, lip=66.85.158.92, TLS, session=<U3x+EZZG9Zy594nB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 08:54:08 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:58500: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-23 08:56:29 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:38096: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-12-23 08:56:32 dovecot_login authenticator failed for H=(abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:51264: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-23 08:56:52 dovecot_login authenticator failed for H=([182.95.215.9]) [182.95.227.70]:33736: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.199
country_id: 6252001
description:
Dec 23 09:00:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.199, lip=66.85.158.92, session=<KTCeKJZGGPDG6xjH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-23 09:01:25 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:50480: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-23 09:01:08 dovecot_login authenticator failed for H=([65.20.143.159]) [65.20.143.159]:42108: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 09:01:31 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:12384: 535 Incorrect authentication data (set_id=help@seyawin.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.170.57.236
country_id: 6252001
description:
[2025-12-23 09:03:06 +0530] info [webmaild] 98.170.57.236 - info@sivagnanamfoundation.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.164.1.102
country_id: 1605651
description:
2025-12-23 09:04:14 dovecot_plain authenticator failed for H=(localhost) [43.164.1.102]:57644: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-23 09:05:01 dovecot_login authenticator failed for H=(cm-178.232.126.146.get.no) [178.232.126.146]:57091: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-23 09:05:15 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:41618: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.103.100.170
country_id: 2542007
description:
2025-12-23 09:06:43 dovecot_plain authenticator failed for H=(DESKTOP-7JPG7RH.home) [102.103.100.170]:64625: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 09:08:18 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:60692: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 09:08:46 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:33266: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 09:09:45 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:39822: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 09:13:15 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:45030: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 09:15:00 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:41240: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.222
country_id: 2510769
description:
Dec 23 09:15:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.74.240.222, lip=66.85.158.91, TLS, session=<f9bjXZZGxsW5SvDe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-23 09:14:49 dovecot_login authenticator failed for H=(149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:59102: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-23 09:14:48 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:44684: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.110
country_id: 3865483
description:
Dec 23 09:15:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.181.109.110, lip=66.85.158.91, TLS, session=<RpEdX5ZG/4u+tW1u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-12-23 09:15:56 dovecot_login authenticator failed for H=(bb151-192-57-118.singnet.com.sg) [151.192.57.118]:53027: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-12-23 09:16:23 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:36458: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 09:17:40 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:51626: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-23 09:18:33 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:42760: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-12-23 09:18:47 dovecot_login authenticator failed for H=([209.23.72.144]) [209.23.72.144]:34998: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.6.176
country_id: 298795
description:
2025-12-23 09:20:14 dovecot_login authenticator failed for H=([188.59.6.176]) [188.59.6.176]:59915: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.238
country_id: 3469034
description:
Dec 23 09:20:21 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=45.183.92.238, lip=66.85.158.91, TLS, session=<hfxBcJZGbYstt1zu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-23 09:19:42 dovecot_login authenticator failed for H=([128.185.247.231]) [182.95.225.114]:35906: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.5.108.126
country_id: 2186224
description:
Dec 23 09:20:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=103.5.108.126, lip=66.85.158.91, TLS, session=<dIrtbpZGQrtnBWx+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.98.71
country_id: 3144096
description:
2025-12-23 09:20:31 dovecot_login authenticator failed for H=(cm-46.212.98.71.get.no) [46.212.98.71]:35390: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-23 09:20:31 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:65409: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-23 09:20:39 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:26680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-23 09:20:59 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:55402: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-23 09:21:27 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com [95.210.105.202]:61386: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-12-23 09:22:02 dovecot_login authenticator failed for H=([182.79.85.38]) [182.79.85.38]:45632: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-23 09:21:45 dovecot_login authenticator failed for H=([122.184.136.185]) [182.95.181.22]:42838: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.198.32.224
country_id: 6251999
description:
Dec 23 09:24:03 host2 pure-ftpd[448529]: (?@143.198.32.224) [INFO] New connection from 143.198.32.224


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:24:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<OQ7bgJZGpKMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:26:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ho5OhpZGxtoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:26:56 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<B9voiJZGfoIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:27:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<JWg1i5ZGjM0DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.16.99
country_id: 3144096
description:
2025-12-23 09:30:09 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.16.99]:33469: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.198.32.224
country_id: 6251999
description:
Dec 23 09:30:09 host2 pure-ftpd[453675]: (?@143.198.32.224) [INFO] New connection from 143.198.32.224


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:29:58 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<UnnGk5ZGIpkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.84.31
country_id: 3996063
description:
2025-12-23 09:30:01 dovecot_login authenticator failed for H=([127.0.0.1]) [187.161.84.31]:54277: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 09:30:30 host2 pure-ftpd[453930]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:30:43 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cph6lpZGzpIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:32:13 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PqzRm5ZG4JoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 09:33:17 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:39414: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:32:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XoIwnpZGioYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:34:18 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<lOQ9o5ZG/McDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 09:34:36 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<WUtRpJZGVIIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 09:35:53 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:42276: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.61.91
country_id: 6252001
description:
Dec 23 09:37:16 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.61.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<enncrZZGKJ4Uoz1b>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 09:38:20 host2 sshd[459632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 09:39:09 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:34266: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 09:39:41 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:60472: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-23 09:40:21 dovecot_login authenticator failed for H=([182.95.181.166]) [182.95.181.166]:37956: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-12-23 09:40:40 dovecot_login authenticator failed for H=([128.185.223.219]) [27.123.111.114]:49706: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 09:42:51 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:55708: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.188
country_id: 1733045
description:
2025-12-23 09:44:14 dovecot_login authenticator failed for H=([49.124.159.188]) [49.124.159.188]:49356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 09:44:23 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:50056: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-23 09:43:30 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:45008: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 23 09:44:09 host2 sshd[463953]: Disconnected from invalid user julien 190.0.63.226 port 37942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-23 09:45:20 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:55831: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 09:44:30 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:30526: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 23 09:45:42 host2 sshd[465579]: Disconnected from invalid user eacadm 190.0.63.226 port 59274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-23 09:45:48 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:36124: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 23 09:47:05 host2 sshd[466518]: Disconnected from invalid user hadi 190.0.63.226 port 55430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 09:48:13 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:5047: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec 23 09:48:15 host2 sshd[467618]: Disconnected from invalid user openhabian 147.50.227.79 port 46240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Dec 23 09:49:09 host2 sshd[468508]: Disconnected from invalid user onkar 152.32.135.139 port 44682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 09:49:14 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:53106: 535 Incorrect authentication data (set_id=office@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 23 09:49:27 host2 sshd[468761]: Disconnected from invalid user ria 154.92.14.191 port 39830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-23 09:48:32 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:59690: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-23 09:48:57 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:3976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Dec 23 09:49:33 host2 sshd[468846]: Disconnected from invalid user mc 103.149.27.208 port 50528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 09:50:05 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:29134: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.227.79
country_id: 1605651
description:
Dec 23 09:50:14 host2 sshd[469561]: Disconnected from invalid user rootuser 147.50.227.79 port 42248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Dec 23 09:50:21 host2 sshd[469701]: Disconnected from invalid user anything 152.32.135.139 port 44358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-23 09:51:00 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:60272: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-23 09:51:17 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:57774: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Dec 23 09:51:21 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<p7ob4JZGBoLE+2YL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.135.139
country_id: 1819730
description:
Dec 23 09:52:12 host2 sshd[471233]: Disconnected from invalid user eacadm 152.32.135.139 port 33046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 23 09:52:31 host2 sshd[471552]: Disconnected from invalid user wafer 154.92.14.191 port 60130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Dec 23 09:53:22 host2 sshd[472149]: Disconnected from invalid user rootuser 103.149.27.208 port 38740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-23 09:53:27 dovecot_login authenticator failed for H=([65.191.211.33]) [65.191.211.33]:57206: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.174
country_id: 6252001
description:
Dec 23 09:56:08 host2 pure-ftpd[475392]: (?@40.124.175.174) [INFO] New connection from 40.124.175.174


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-23 09:56:20 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [109.69.15.132]:53940: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 23 09:55:28 host2 sshd[474720]: Disconnected from invalid user web 154.92.14.191 port 52184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Dec 23 09:55:39 host2 sshd[475025]: Disconnected from invalid user kira 103.149.27.208 port 37882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-23 09:56:39 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:50204: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-23 09:57:37 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:48736: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-23 09:57:49 dovecot_login authenticator failed for H=([102.38.3.179]) [102.38.3.179]:35374: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec 23 09:59:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2q+c/JZGZ8WTuYRC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Dec 23 10:00:05 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<oJRW/5ZG0LzE+2YR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Dec 23 10:00:20 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<UZ1GAJdGirLE+2YQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:01:05 host2 sshd[479874]: Disconnected from invalid user tom 189.90.33.23 port 39528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.118
country_id: 3469034
description:
Dec 23 10:01:38 host2 sshd[480341]: Disconnected from invalid user hadi 189.47.10.118 port 43300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:03:05 host2 sshd[481750]: Disconnected from invalid user couchdb 189.90.33.23 port 45722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:02:24 host2 sshd[481055]: Disconnected from invalid user sybase 189.90.33.23 port 60050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:03:46 host2 sshd[482351]: Disconnected from invalid user cron 189.90.33.23 port 59646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.132.193
country_id: 3469034
description:
Dec 23 10:04:20 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=191.53.132.193, lip=66.85.158.91, TLS, session=<NzyaDZdGtei/NYTB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 23 10:04:29 host2 sshd[483390]: Disconnected from invalid user smbuser 189.90.33.23 port 45370 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.177
country_id: 3469034
description:
Dec 23 10:04:40 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=138.36.202.177, lip=66.85.158.91, TLS, session=<gq/JDpdGJZiKJMqx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 10:08:01 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:43354: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.118
country_id: 3469034
description:
Dec 23 10:07:36 host2 sshd[487363]: Disconnected from invalid user user 189.47.10.118 port 40118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-23 10:07:38 dovecot_login authenticator failed for H=(189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:34246: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-23 10:07:53 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:50995: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 10:11:23 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:55458: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 10:11:29 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:44090: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-23 10:12:08 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:53577: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-23 10:12:09 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:59211: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.209.252.105
country_id: 6252001
description:
2025-12-23 10:13:21 dovecot_plain authenticator failed for H=ec2-54-209-252-105.compute-1.amazonaws.com (EC2AMAZ-5DRTN3Q.ec2.internal) [54.209.252.105]:55245: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-23 10:12:36 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:36337: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.118
country_id: 3469034
description:
Dec 23 10:12:37 host2 sshd[493766]: Disconnected from invalid user eacadm 189.47.10.118 port 52538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 10:12:53 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:36576: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-23 10:13:16 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:42076: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.209.252.105
country_id: 6252001
description:
2025-12-23 10:13:27 dovecot_login authenticator failed for H=ec2-54-209-252-105.compute-1.amazonaws.com (EC2AMAZ-5DRTN3Q.ec2.internal) [54.209.252.105]:55245: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 10:17:33 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:51866: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-23 10:18:00 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:44959: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 10:18:32 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:42002: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-23 10:19:39 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:48326: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-23 10:19:54 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:41134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-23 10:20:38 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:57858: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 10:24:47 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:57328: 535 Incorrect authentication data (set_id=help@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-23 10:25:08 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:45745: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-23 10:24:43 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:47628: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 10:25:55 host2 sshd[507142]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 10:25:52 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:53020: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 10:26:47 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:40176: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.22
country_id: 226074
description:
Dec 23 10:32:42 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=196.0.122.22, lip=66.85.158.91, TLS, session=<7PDzcpdGuNfEAHoW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 10:33:03 host2 pure-ftpd[513164]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.83
country_id: 1269750
description:
Dec 23 10:33:06 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.70.126.83, lip=66.85.158.91, TLS, session=<w3NMdJdG/INnRn5T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-23 10:34:05 dovecot_login authenticator failed for H=(187-163-97-62.cust.smartcall.no) [62.97.163.187]:55716: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-23 10:34:20 dovecot_login authenticator failed for H=([203.147.89.38]) [203.147.89.158]:42010: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 10:34:25 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:60018: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.132.127.172
country_id: 2750405
description:
2025-12-23 10:34:32 dovecot_plain authenticator failed for H=172-127-132-5.ftth.glasoperator.nl (localhost) [5.132.127.172]:48658: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.206
country_id: 6252001
description:
Dec 23 10:34:42 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.206, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YIhFe5dGEsIUQGnO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 10:35:17 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:38754: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Dec 23 10:35:18 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<0iJTfZdGjI/E+2YM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 10:39:13 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:59242: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 10:40:23 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:39448: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.40.125.62
country_id: 732800
description:
Dec 23 10:41:19 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=46.40.125.62, lip=66.85.158.91, TLS, session=</3n2kZdGa5UuKH0+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 10:40:31 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:47262: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.135.154
country_id: 6290252
description:
Dec 23 10:41:37 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.234.135.154, lip=66.85.158.91, TLS, session=<TjgDk5dGt7db6oea>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.180.151
country_id: 2802361
description:
Dec 23 10:42:31 host2 pure-ftpd[521400]: (?@35.195.180.151) [INFO] New connection from 35.195.180.151


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.215.145.207
country_id: 6252001
description:
Dec 23 10:43:29 host2 pure-ftpd[522352]: (?@172.215.145.207) [INFO] New connection from 172.215.145.207


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2025-12-23 10:46:00 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:33020: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.49
country_id: 3996063
description:
2025-12-23 10:46:25 dovecot_login authenticator failed for H=(187.161.198.49-clientes-izzi.mx) [187.161.198.49]:50650: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-23 10:46:41 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:49382: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-23 10:46:57 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:60086: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-23 10:47:10 dovecot_login authenticator failed for H=50708de6.static.ziggozakelijk.nl [80.112.141.230]:45984: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 10:48:35 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:44437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-23 10:49:05 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:48638: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-23 10:50:02 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:33930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-23 10:49:40 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:57221: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.168
country_id: 6252001
description:
Dec 23 10:49:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PKPasJdGVdLG6xio>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-23 10:51:23 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:33884: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-23 10:52:09 dovecot_login authenticator failed for H=([125.19.165.242]) [125.19.188.98]:38964: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.128.241.207
country_id: 2661886
description:
2025-12-23 10:53:32 dovecot_login authenticator failed for H=195-128-241-207.bredband.obenetwork.net [195.128.241.207]:59408: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-12-23 10:53:45 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:47214: 535 Incorrect authentication data (set_id=maximsholdings.com@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-23 10:53:51 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:55464: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-23 10:54:12 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:16120: 535 Incorrect authentication data (set_id=maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 10:56:54 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:53666: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.164.1.102
country_id: 1605651
description:
2025-12-23 10:57:30 dovecot_plain authenticator failed for H=(localhost) [43.164.1.102]:44190: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-12-23 10:59:04 dovecot_login authenticator failed for H=(2-55-68-141.orange.net.il) [2.55.68.141]:44604: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-23 10:59:15 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:59336: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.188
country_id: 6252001
description:
Dec 23 11:04:24 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.188, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<fcCD5ZdGR8yTuYS8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.188
country_id: 6252001
description:
Dec 23 11:09:45 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.188, lip=66.85.158.92, TLS, session=<xMqf+JdGGOOTuYS8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.149.110
country_id: 690791
description:
Dec 23 11:09:28 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=37.221.149.110, lip=66.85.158.91, TLS, session=<NQqk9pdGW9Ql3ZVu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.74
country_id: 3175395
description:
Dec 23 11:09:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=185.63.133.74, lip=66.85.158.91, TLS, session=<AvCq95dGv5K5P4VK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 11:10:57 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:54918: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 23 11:12:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<rjurAJhG+KgjygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 11:16:19 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:12027: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.171
country_id: 1733045
description:
2025-12-23 11:23:59 dovecot_login authenticator failed for H=([49.124.152.171]) [49.124.152.171]:45422: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-23 11:24:26 dovecot_login authenticator failed for H=([178.239.238.23]) [178.239.238.23]:52272: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 11:25:57 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:36968: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 11:27:43 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:53024: 535 Incorrect authentication data (set_id=sales@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 11:30:58 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:47678: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 11:32:45 host2 sshd[565040]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 11:35:39 host2 pure-ftpd[567826]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.113.201
country_id: 6251999
description:
Dec 23 11:41:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.113.201, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<iglqaZhG/pefWXHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.168.66
country_id: 1819730
description:
2025-12-23 11:41:18 dovecot_login authenticator failed for H=([43.245.168.66]) [43.245.168.66]:44409: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-23 11:41:43 dovecot_login authenticator failed for H=(92.62.243.175.fibermax.bg) [92.62.243.175]:43289: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.140.92
country_id: 99237
description:
Dec 23 11:42:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=65.20.140.92, lip=66.85.158.91, TLS, session=<8Wela5hGn4VBFIxc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.36.250
country_id: 6290252
description:
Dec 23 11:42:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=109.207.36.250, lip=66.85.158.91, TLS, session=<XnSga5hGQ5BtzyT6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 151.232.56.144
country_id: 130758
description:
Dec 23 11:42:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=151.232.56.144, lip=66.85.158.91, TLS, session=<pVLCbJhGWoKX6DiQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.173
country_id: 3175395
description:
Dec 23 11:42:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=185.197.9.173, lip=66.85.158.91, TLS, session=<rdP5bJhGd4G5xQmt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 11:44:38 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:54538: 535 Incorrect authentication data (set_id=office@venee.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.120.195
country_id: 6252001
description:
[2025-12-23 11:45:41 +0530] info [whostmgrd] 172.58.120.195 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.237.24.59
country_id: 6252001
description:
[2025-12-23 11:45:44 +0530] info [cpaneld] 167.237.24.59 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-23 11:46:14 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:47625: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.42.108.155
country_id: 6252001
description:
[2025-12-23 11:45:36 +0530] info [cpaneld] 47.42.108.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.209.12
country_id: 6252001
description:
[2025-12-23 11:45:40 +0530] info [cpaneld] 99.66.209.12 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.33.202.137
country_id: 6252001
description:
[2025-12-23 11:45:43 +0530] info [cpaneld] 73.33.202.137 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.241.0.57
country_id: 6252001
description:
[2025-12-23 11:45:46 +0530] info [cpaneld] 104.241.0.57 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.56.120.183
country_id: 6252001
description:
[2025-12-23 11:45:38 +0530] info [cpaneld] 208.56.120.183 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-23 11:46:37 dovecot_login authenticator failed for H=([128.185.247.210]) [182.79.89.14]:34050: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-12-23 11:46:33 dovecot_login authenticator failed for H=(76.73.197.124.unknown.m1.com.sg) [124.197.73.76]:54137: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Dec 23 11:47:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.123, lip=66.85.158.91, TLS, session=<quW7f5hG1PSTuYR7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-12-23 11:48:09 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:22843: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-23 11:48:22 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:46186: 535 Incorrect authentication data (set_id=bostonlanka.com@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-12-23 11:48:22 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:39688: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-23 11:48:46 dovecot_login authenticator failed for H=(cm-46.212.39.201.get.no) [46.212.39.201]:37457: 535 Incorrect authentication data (set_id=bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-12-23 11:49:42 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:64081: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-23 11:50:15 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:47688: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.255.73.42
country_id: 1269750
description:
[2025-12-23 11:53:57 +0530] info [webmaild] 103.255.73.42 - info@simple-engineering.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@simple-engineering.lk has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Dec 23 11:56:05 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<oWo5nphG1IjE+2YN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 11:59:34 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:57010: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 12:00:08 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<JceyrJhG5oXBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-23 12:03:15 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:60960: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 12:03:50 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:52138: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-23 12:03:45 dovecot_login authenticator failed for H=([152.52.229.14]) [152.52.229.14]:42324: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2025-12-23 12:04:34 dovecot_login authenticator failed for H=(fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:33312: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 23 12:04:50 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<r4edvZhG9mlChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-23 12:05:26 dovecot_login authenticator failed for H=78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:54318: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 12:09:05 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58614: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 23 12:10:10 host2 sshd[602832]: Disconnected from invalid user es 122.53.133.167 port 45884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Dec 23 12:12:08 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<ZbmU15hGtqfE+2YP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 23 12:11:53 host2 sshd[604378]: Disconnected from invalid user hdoop 122.53.133.167 port 45184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:13:13 host2 sshd[605539]: Disconnected from invalid user auditor 190.181.25.210 port 39517 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:14:29 host2 sshd[606622]: Disconnected from invalid user rich 190.181.25.210 port 49238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:15:12 host2 sshd[607483]: Disconnected from invalid user redmine 190.181.25.210 port 56133 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 23 12:15:24 host2 sshd[607667]: Disconnected from invalid user oem 122.53.133.167 port 43820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:15:57 host2 sshd[608126]: Disconnected from invalid user ansible 190.181.25.210 port 34795 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-23 12:16:06 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:34242: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-12-23 12:16:27 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:56396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec 23 12:16:38 host2 sshd[608772]: Disconnected from invalid user joshua 190.181.25.210 port 41690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Dec 23 12:17:10 host2 sshd[609251]: Disconnected from invalid user admin 122.53.133.167 port 43118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-23 12:18:11 dovecot_login authenticator failed for H=(186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:48917: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-23 12:18:15 dovecot_login authenticator failed for H=(30-170-97-62.cust.smartcall.no) [62.97.170.30]:45127: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.200
country_id: 6252001
description:
Dec 23 12:18:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.200, lip=66.85.158.91, session=<zXTg75hGqPDG6xjI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-23 12:19:02 dovecot_login authenticator failed for H=(static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:47514: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 23 12:19:35 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<PIFZ8phGP//CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-23 12:20:06 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:48703: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 12:20:26 host2 sshd[612412]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2025-12-23 12:20:21 dovecot_login authenticator failed for H=([127.0.0.1]) [152.52.244.106]:56186: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-23 12:20:28 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:55233: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2025-12-23 12:20:40 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.231.114]:34526: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 12:23:17 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:43766: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Dec 23 12:24:59 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<gwmRBZlGhsHE+2YS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-12-23 12:27:36 dovecot_login authenticator failed for H=([217.26.194.79]) [217.26.194.79]:42746: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 23 12:27:41 host2 sshd[618287]: Disconnected from invalid user mongodb 200.77.172.159 port 40814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2025-12-23 12:28:00 dovecot_login authenticator failed for H=([49.124.153.40]) [49.124.153.40]:58448: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 23 12:30:00 host2 sshd[619847]: Disconnected from invalid user tsbot 200.77.172.159 port 53222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 23 12:30:38 host2 sshd[620606]: Disconnected from invalid user delete 200.77.172.159 port 39178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 23 12:30:40 host2 sshd[620631]: Disconnected from invalid user vyos 51.83.71.110 port 43654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-23 12:31:18 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:42670: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.59
country_id: 6252001
description:
Dec 23 12:32:42 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.59, lip=66.85.158.92, TLS, session=<KAxMIZlG/PbN0h87>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-23 12:33:38 dovecot_login authenticator failed for H=(cm-84.213.191.55.get.no) [84.213.191.55]:42031: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 23 12:33:50 host2 sshd[623172]: Disconnected from invalid user xerox 51.83.71.110 port 59372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 23 12:34:49 host2 sshd[623837]: Disconnected from invalid user client 51.83.71.110 port 54304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 12:35:01 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:37840: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.160.113.134
country_id: 6252001
description:
[2025-12-23 12:37:56 +0530] info [cpaneld] 67.160.113.134 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 12:37:38 host2 pure-ftpd[626174]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.154.35
country_id: 6252001
description:
[2025-12-23 12:37:49 +0530] info [cpaneld] 35.150.154.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.92.193
country_id: 6252001
description:
[2025-12-23 12:37:53 +0530] info [cpaneld] 47.32.92.193 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.153.13.111
country_id: 6252001
description:
[2025-12-23 12:37:55 +0530] info [cpaneld] 63.153.13.111 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.255.176
country_id: 6252001
description:
[2025-12-23 12:37:47 +0530] info [cpaneld] 129.222.255.176 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.41.184
country_id: 6252001
description:
[2025-12-23 12:37:50 +0530] info [cpaneld] 73.92.41.184 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.145.179.89
country_id: 6252001
description:
[2025-12-23 12:37:51 +0530] info [whostmgrd] 47.145.179.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.67.26.55
country_id: 6252001
description:
[2025-12-23 12:43:42 +0530] info [cpaneld] 173.67.26.55 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.213.164.108
country_id: 6252001
description:
[2025-12-23 12:43:44 +0530] info [cpaneld] 98.213.164.108 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.250.228.152
country_id: 6252001
description:
[2025-12-23 12:43:37 +0530] info [cpaneld] 73.250.228.152 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.124.74.226
country_id: 6252001
description:
[2025-12-23 12:43:38 +0530] info [cpaneld] 76.124.74.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.213.22.86
country_id: 6252001
description:
[2025-12-23 12:43:40 +0530] info [cpaneld] 72.213.22.86 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.239.192.142
country_id: 6252001
description:
[2025-12-23 12:43:41 +0530] info [whostmgrd] 73.239.192.142 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.185.250.99
country_id: 6252001
description:
[2025-12-23 12:43:43 +0530] info [cpaneld] 24.185.250.99 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.94.203.35
country_id: 3469034
description:
Dec 23 12:47:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.94.203.35, lip=66.85.158.91, TLS, session=<sHJkU5lG0qGKXssj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.74.181.139
country_id: 130758
description:
Dec 23 12:46:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=94.74.181.139, lip=66.85.158.91, TLS, session=<ckowUplGHd1eSrWL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-23 12:49:03 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:45506: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-23 12:49:27 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:60968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.22.170
country_id: 192950
description:
Dec 23 12:56:16 host2 sshd[642342]: Invalid user cloudtourssrilan_travel from 102.220.22.170 port 48682


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.39
country_id: 798544
description:
Dec 23 12:57:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.228.32.39, lip=66.85.158.91, TLS, session=<kEepeJlGYYtb5CAn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.233
country_id: 3469034
description:
Dec 23 12:57:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=179.189.201.233, lip=66.85.158.91, TLS, session=<aqTCeZlG5uGzvcnp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-23 12:57:48 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:42850: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-23 12:58:18 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:12470: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-23 13:00:36 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:50007: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-23 13:01:01 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:50113: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:01:15 host2 sshd[646339]: Disconnected from invalid user team1 186.30.115.187 port 40792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:03:13 host2 sshd[647611]: Disconnected from invalid user cosmos 186.30.115.187 port 38086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.30.115.187
country_id: 3686110
description:
Dec 23 13:03:55 host2 sshd[648190]: Disconnected from invalid user none 186.30.115.187 port 50214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:05:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<VFPClplGbNMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:06:59 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<9cXnm5lGcMUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:08:44 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<wbcfoplGoOIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-23 13:09:03 dovecot_login authenticator failed for H=([125.17.182.121]) [182.95.224.62]:34896: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-23 13:09:14 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:48338: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:10:16 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<d9ijp5lGSsoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:10:31 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<7JyLqJlG9L8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:11:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<PaZgrZlGKtADhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:12:00 host2 dovecot[3805015]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<LsHVrZlGjLgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-23 13:13:26 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:51728: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-23 13:14:06 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:60738: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:14:17 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<xzX6tZlGyMQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:14:34 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<QWkCt5lGhKoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-23 13:15:17 dovecot_login authenticator failed for H=([152.52.231.202]) [152.52.231.202]:59432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-23 13:15:58 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:45016: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-23 13:16:31 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:46831: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-23 13:18:45 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:49000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.194.197
country_id: 3175395
description:
Dec 23 13:19:19 host2 sshd[660748]: Disconnected from invalid user ocadmin 151.44.194.197 port 9335 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.44.194.197
country_id: 3175395
description:
Dec 23 13:21:46 host2 sshd[662716]: Disconnected from invalid user client 151.44.194.197 port 9509 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.103.188.111
country_id: 6252001
description:
[2025-12-23 13:24:06 +0530] info [cpaneld] 76.103.188.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.48.200.40
country_id: 6252001
description:
[2025-12-23 13:24:08 +0530] info [cpaneld] 73.48.200.40 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.185.10.248
country_id: 6252001
description:
[2025-12-23 13:24:10 +0530] info [whostmgrd] 67.185.10.248 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.63.197.20
country_id: 6252001
description:
[2025-12-23 13:24:13 +0530] info [cpaneld] 99.63.197.20 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.199.187.196
country_id: 6252001
description:
[2025-12-23 13:24:15 +0530] info [cpaneld] 161.199.187.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.204
country_id: 1733045
description:
2025-12-23 13:23:36 dovecot_login authenticator failed for H=([49.124.149.204]) [49.124.149.204]:52810: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.87.252.56
country_id: 6252001
description:
[2025-12-23 13:24:03 +0530] info [cpaneld] 76.87.252.56 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.197.30.247
country_id: 6252001
description:
[2025-12-23 13:24:12 +0530] info [cpaneld] 76.197.30.247 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-12-23 13:24:10 dovecot_login authenticator failed for H=(201.173.92.100-clientes-izzi.mx) [201.173.92.100]:55299: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-23 13:25:50 dovecot_login authenticator failed for H=(cm-178.232.240.121.get.no) [178.232.240.121]:39500: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.242.241.133
country_id: 6252001
description:
[2025-12-23 13:25:57 +0530] info [cpaneld] 69.242.241.133 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.176.11.232
country_id: 6252001
description:
[2025-12-23 13:25:58 +0530] info [cpaneld] 98.176.11.232 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.241.90.115
country_id: 6252001
description:
[2025-12-23 13:26:07 +0530] info [cpaneld] 75.241.90.115 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.165.139
country_id: 6252001
description:
[2025-12-23 13:25:39 +0530] info [cpaneld] 209.50.165.139 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.138.176.146
country_id: 6252001
description:
[2025-12-23 13:26:01 +0530] info [whostmgrd] 66.138.176.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.204.60.117
country_id: 6252001
description:
[2025-12-23 13:26:00 +0530] info [cpaneld] 73.204.60.117 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.80.132.91
country_id: 6252001
description:
[2025-12-23 13:26:06 +0530] info [cpaneld] 71.80.132.91 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.213.28.165
country_id: 6252001
description:
[2025-12-23 13:26:09 +0530] info [cpaneld] 71.213.28.165 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-23 13:26:15 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:37486: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 13:27:26 host2 sshd[667114]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.233.156.64
country_id: 1269750
description:
Dec 23 13:27:43 host2 sshd[667292]: Disconnected from invalid user stack 13.233.156.64 port 36250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 23 13:27:53 host2 sshd[667398]: Disconnected from invalid user bb 158.69.210.167 port 41440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.233.156.64
country_id: 1269750
description:
Dec 23 13:28:57 host2 sshd[668093]: Disconnected from invalid user hadoopuser 13.233.156.64 port 39152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 23 13:28:57 host2 sshd[668145]: Disconnected from invalid user itadmin 158.69.210.167 port 37190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-12-23 13:29:13 dovecot_login authenticator failed for H=(126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:54790: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 23 13:28:29 host2 sshd[667801]: Disconnected from invalid user hadoopuser 129.226.150.85 port 60344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-23 13:29:29 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:56068: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.153
country_id: 1733045
description:
2025-12-23 13:32:03 dovecot_login authenticator failed for H=([49.124.152.153]) [49.124.152.153]:40744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:32:27 host2 sshd[671342]: Disconnected from invalid user clare 20.123.146.92 port 12126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-12-23 13:32:30 dovecot_login authenticator failed for H=(31-154-122-202.orange.net.il) [2.55.122.202]:54312: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Dec 23 13:33:24 host2 sshd[672032]: Disconnected from invalid user debian 20.123.146.93 port 60626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.22.170
country_id: 192950
description:
Dec 23 13:34:29 host2 sshd[672924]: Invalid user cloudtourssrilan_travel from 102.220.22.170 port 50524


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:36:24 host2 sshd[674463]: Disconnected from invalid user julio 20.123.146.92 port 64566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-12-23 13:37:50 dovecot_login authenticator failed for H=([102.214.44.117]) [102.214.44.117]:49586: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:37:31 host2 sshd[675217]: Disconnected from invalid user practice 20.123.146.92 port 65055 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-23 13:38:28 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:59306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 13:39:05 host2 pure-ftpd[676501]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:39:47 host2 sshd[676881]: Disconnected from invalid user backupuser 20.123.146.92 port 55906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 23 13:42:06 host2 sshd[678948]: Disconnected from invalid user qa 4.210.186.201 port 31886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-23 13:43:11 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:45408: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 23 13:43:39 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, session=<Wez8HppGrqJChJmM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-23 13:43:56 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:43892: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-23 13:43:34 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:55818: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 23 13:46:45 host2 sshd[683831]: Disconnected from invalid user prova 20.123.146.92 port 20956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.94
country_id: 2750405
description:
Dec 23 13:47:57 host2 sshd[684759]: Disconnected from invalid user ann 20.123.146.94 port 45721 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Dec 23 13:49:17 host2 sshd[685873]: Disconnected from invalid user forum 20.123.146.93 port 19715 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:50:23 host2 sshd[686833]: Disconnected from invalid user pula 68.183.46.135 port 58162 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 13:51:01 host2 sshd[687063]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-12-23 13:52:58 dovecot_login authenticator failed for H=(m121-202-195-194.smartone.com) [121.202.195.194]:37163: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 13:53:21 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:58294: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:54:03 host2 sshd[689388]: Disconnected from invalid user cssserver 68.183.46.135 port 43666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec 23 13:53:27 host2 sshd[688930]: Disconnected from invalid user cacheusr 196.188.120.232 port 54732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:53:32 host2 sshd[688985]: Disconnected from invalid user abel 68.183.46.135 port 47788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 23 13:55:15 host2 sshd[690805]: Disconnected from invalid user local 4.210.186.201 port 37528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Dec 23 13:55:24 host2 sshd[690944]: Disconnected from invalid user cvs 196.188.120.232 port 53650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 23 13:54:33 host2 sshd[690224]: Disconnected from invalid user marie 68.183.46.135 port 43932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.122
country_id: 226074
description:
Dec 23 13:56:20 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=196.0.122.122, lip=66.85.158.91, TLS, session=<Hy0AS5pGccrEAHp6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:56:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<XBCpTJpGUNADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2025-12-23 13:55:32 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:50079: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-23 13:55:58 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:45247: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:56:37 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<+EZmTZpGbqsDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.189
country_id: 3865483
description:
Dec 23 13:56:41 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.238.106.189, lip=66.85.158.91, TLS, session=<cDOCTJpG1eYt7mq9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.19.191
country_id: 6252001
description:
[2025-12-23 13:57:30 +0530] info [cpaneld] 73.170.19.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.186.83.157
country_id: 6252001
description:
[2025-12-23 13:57:35 +0530] info [cpaneld] 65.186.83.157 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.178.24
country_id: 6252001
description:
[2025-12-23 13:57:37 +0530] info [cpaneld] 172.56.178.24 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.16.76.113
country_id: 6252001
description:
[2025-12-23 13:57:31 +0530] info [cpaneld] 100.16.76.113 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.55.59.6
country_id: 6252001
description:
[2025-12-23 13:57:32 +0530] info [cpaneld] 136.55.59.6 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.88.62.38
country_id: 6252001
description:
[2025-12-23 13:57:34 +0530] info [whostmgrd] 99.88.62.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.62.47.202
country_id: 6252001
description:
[2025-12-23 13:57:36 +0530] info [cpaneld] 170.62.47.202 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 23 13:58:01 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<bW9gUppG7qgDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 211.25.245.56
country_id: 1733045
description:
Dec 23 14:00:53 host2 sshd[695410]: Disconnected from invalid user admin 211.25.245.56 port 45228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.198.249
country_id: 2510769
description:
Dec 23 14:01:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=45.135.198.249, lip=66.85.158.91, TLS, session=<z85PXJpGAbIth8b5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.14.20.239
country_id: 798549
description:
Dec 23 14:00:46 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=31.14.20.239, lip=66.85.158.91, TLS, session=<WfU7W5pGUZMfDhTv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 23 14:02:29 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS: Connection closed, session=<sT5jYppGvpxChJmJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:03:13 host2 sshd[697232]: Disconnected from invalid user vmail 45.12.131.121 port 46296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:03:45 host2 sshd[697554]: Disconnected from invalid user ceshi 45.12.131.121 port 53150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.12.131.121
country_id: 2264397
description:
Dec 23 14:05:22 host2 sshd[699013]: Disconnected from invalid user deb 45.12.131.121 port 50754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.25.245.56
country_id: 1733045
description:
Dec 23 14:05:40 host2 sshd[699211]: Disconnected from invalid user afa 211.25.245.56 port 46672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-23 14:07:42 dovecot_login authenticator failed for H=(210-167-97-62.cust.smartcall.no) [62.97.167.210]:39086: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-23 14:07:53 dovecot_login authenticator failed for H=(cm-178.232.221.194.get.no) [178.232.221.194]:58483: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-23 14:10:44 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:54371: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-23 14:11:34 dovecot_login authenticator failed for H=([27.123.113.10]) [27.123.113.10]:35074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-23 14:11:39 dovecot_login authenticator failed for H=([182.95.22.249]) [128.185.194.22]:41430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2025-12-23 14:13:23 dovecot_login authenticator failed for H=([49.124.147.96]) [49.124.147.96]:52588: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.62
country_id: 1733045
description:
2025-12-23 14:13:40 dovecot_login authenticator failed for H=([49.124.151.62]) [49.124.151.62]:48276: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.211
country_id: 1733045
description:
2025-12-23 14:13:56 dovecot_login authenticator failed for H=([49.124.149.211]) [49.124.149.211]:50528: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 14:15:11 host2 sshd[709635]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-23 14:15:35 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:34493: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-23 14:15:46 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:45869: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-23 14:15:58 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:41768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-23 14:16:40 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:60532: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.14
country_id: 6252001
description:
Dec 23 14:17:06 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.14, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uwmllppGs7Nb5qgO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.0
country_id: 6252001
description:
Dec 23 14:17:17 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.0, lip=66.85.158.92, TLS: Connection closed, session=<xDJJl5pGyetb5qgA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.11
country_id: 6252001
description:
Dec 23 14:17:25 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.11, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LMPFl5pGFa9b5qgL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.1
country_id: 6252001
description:
Dec 23 14:17:28 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.1, lip=66.85.158.92, TLS: Connection closed, session=<mi/0l5pGKblb5qgB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-23 14:20:25 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:35926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.153.103.91
country_id: 6252001
description:
[2025-12-23 14:20:33 +0530] info [cpaneld] 47.153.103.91 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.165.48.12
country_id: 6252001
description:
[2025-12-23 14:20:38 +0530] info [cpaneld] 67.165.48.12 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-23 14:20:42 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:45210: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.178.188.52
country_id: 6252001
description:
[2025-12-23 14:20:39 +0530] info [cpaneld] 72.178.188.52 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.131.224.44
country_id: 6252001
description:
[2025-12-23 14:20:41 +0530] info [cpaneld] 24.131.224.44 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.63.219.187
country_id: 6252001
description:
[2025-12-23 14:20:27 +0530] info [cpaneld] 192.63.219.187 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.127.222
country_id: 6252001
description:
[2025-12-23 14:20:31 +0530] info [cpaneld] 216.147.127.222 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.229.67.84
country_id: 6252001
description:
[2025-12-23 14:20:35 +0530] info [whostmgrd] 47.229.67.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-23 14:23:26 dovecot_login authenticator failed for H=(201.173.92.217-clientes-izzi.mx) [201.173.92.217]:50157: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-23 14:24:01 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:59619: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-23 14:26:22 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12068: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-23 14:26:45 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:48210: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-23 14:29:00 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:60314: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-23 14:30:04 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:53841: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.39
country_id: 3017382
description:
Dec 23 14:34:41 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.39, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pJqI1ZpGgZVbxJgn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.120
country_id: 3017382
description:
Dec 23 14:34:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.120, lip=66.85.158.92, TLS: Connection closed, session=<3lIo1ppGh7BbxJh4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.36
country_id: 3017382
description:
Dec 23 14:34:58 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.36, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XMiL1ppGT7xbxJgk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.32
country_id: 3017382
description:
Dec 23 14:35:01 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.32, lip=66.85.158.92, TLS: Connection closed, session=<99G71ppGO5RbxJgg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.37.62
country_id: 3144096
description:
2025-12-23 14:36:10 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.37.62]:55587: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2025-12-23 14:36:21 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.13.203]:42095: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:36:42 host2 sshd[732257]: Disconnected from invalid user switch 95.231.213.73 port 58830 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.189.1
country_id: 6252001
description:
[2025-12-23 14:39:05 +0530] info [cpaneld] 135.129.189.1 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 23 14:39:06 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Yq9Q5ZpGQQnCpRCm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.192.155
country_id: 6252001
description:
[2025-12-23 14:39:04 +0530] info [cpaneld] 136.227.192.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.174.170.100
country_id: 6252001
description:
[2025-12-23 14:39:06 +0530] info [cpaneld] 174.174.170.100 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.222.88.228
country_id: 6252001
description:
[2025-12-23 14:39:08 +0530] info [whostmgrd] 98.222.88.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.245.168.194
country_id: 6252001
description:
[2025-12-23 14:39:09 +0530] info [cpaneld] 96.245.168.194 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.96.29.160
country_id: 6252001
description:
[2025-12-23 14:39:10 +0530] info [cpaneld] 74.96.29.160 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.238.131.44
country_id: 6252001
description:
[2025-12-23 14:39:11 +0530] info [cpaneld] 63.238.131.44 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:40:50 host2 sshd[736610]: Disconnected from invalid user newuser 95.231.213.73 port 55206 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 14:41:43 host2 pure-ftpd[737546]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.248.201.228
country_id: 1210997
description:
Dec 23 14:42:26 host2 sshd[738231]: Disconnected from invalid user tp 161.248.201.228 port 50896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Dec 23 14:44:23 host2 sshd[740188]: Disconnected from invalid user temp 161.248.201.228 port 51468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 23 14:45:11 host2 sshd[741480]: Disconnected from invalid user vpnuser1 95.231.213.73 port 38620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-23 14:46:00 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:51762: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.217.242.98
country_id: 6252001
description:
[2025-12-23 14:46:58 +0530] info [cpaneld] 73.217.242.98 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.57.191.131
country_id: 6252001
description:
[2025-12-23 14:47:01 +0530] info [cpaneld] 104.57.191.131 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.221.245.59
country_id: 6252001
description:
[2025-12-23 14:47:00 +0530] info [cpaneld] 172.221.245.59 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.138.237.124
country_id: 6252001
description:
[2025-12-23 14:47:02 +0530] info [cpaneld] 35.138.237.124 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.213.47
country_id: 6252001
description:
[2025-12-23 14:46:56 +0530] info [cpaneld] 73.151.213.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.51.195.190
country_id: 6252001
description:
[2025-12-23 14:46:57 +0530] info [cpaneld] 130.51.195.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.215.187.127
country_id: 6252001
description:
[2025-12-23 14:46:59 +0530] info [whostmgrd] 47.215.187.127 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-12-23 14:47:41 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-23 14:50:26 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:41246: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.36
country_id: 2635167
description:
Dec 23 14:50:37 host2 dovecot[3805015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.36, lip=66.85.158.92, TLS, session=<eS6IDptG+5+594kk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-23 14:51:00 dovecot_login authenticator failed for H=([49.124.154.160]) [49.124.154.160]:43420: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2025-12-23 14:53:19 dovecot_login authenticator failed for H=([127.0.0.1]) [24.121.1.156]:38440: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.102.252.82
country_id: 1819730
description:
2025-12-23 14:53:31 dovecot_login authenticator failed for H=pcd720082.netvigator.com ([127.0.0.1]) [218.102.252.82]:60540: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.246.24
country_id: 798544
description:
Dec 23 14:54:47 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=109.125.246.24, lip=66.85.158.91, TLS, session=<9xJqHJtGYaJtffYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.129
country_id: 298795
description:
Dec 23 14:55:07 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.67.155.129, lip=66.85.158.91, TLS, session=<kW6SHZtGJrktQ5uB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:56:57 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<v74oJZtG1MMDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.165.170.41
country_id: 3895114
description:
Dec 23 14:59:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=45.165.170.41, lip=66.85.158.91, TLS, session=<E13pLJtGv94tpaop>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-23 14:59:02 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:61274: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:59:20 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Nza1LZtGdsMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.38
country_id: 6252001
description:
Dec 23 14:59:31 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.38, lip=66.85.158.91, TLS, session=<CJtWLptGoPnN0h8m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-23 14:59:33 dovecot_login authenticator failed for H=(73-161-97-62.cust.smartcall.no) [62.97.161.73]:48443: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 14:59:38 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<9z28LptG0s4DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.135.223
country_id: 1269750
description:
Dec 23 14:59:47 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=103.59.135.223, lip=66.85.158.91, TLS, session=<c9YaLptGVM9nO4ff>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-23 15:00:58 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:50155: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:00:30 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<X5DWMZtGtKIDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 23 15:00:38 host2 sshd[756550]: Disconnected from invalid user john1 103.123.53.88 port 36590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-23 15:02:06 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [210.1.66.154]:60365: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-23 15:02:25 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:50520: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-23 15:01:31 dovecot_login authenticator failed for H=([203.125.110.142]) [203.125.83.34]:63189: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 23 15:01:53 host2 sshd[757411]: Disconnected from invalid user jenkins 103.123.53.88 port 43796 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:02:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<gXZ0OZtGkqEDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:02:53 host2 dovecot[3805015]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<B01jOptGVqYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-23 15:03:29 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:3160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-23 15:03:49 dovecot_login authenticator failed for H=(client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:35004: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 23 15:04:39 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<p7+vQJtGTLIDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2025-12-23 15:12:16 dovecot_login authenticator failed for H=([127.0.0.1]) [158.181.19.144]:50500: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.80
country_id: 953987
description:
Dec 23 15:13:19 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.43.80, lip=66.85.158.91, TLS, session=<+HaVXptGmt9mQCtQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.2
country_id: 1733045
description:
2025-12-23 15:14:55 dovecot_login authenticator failed for H=([49.124.151.2]) [49.124.151.2]:52358: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-23 15:16:51 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:52055: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-12-23 15:17:30 dovecot_login authenticator failed for H=(48-253.adsl.static.espeed.com.bn) [118.103.253.48]:42587: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.171.204.144
country_id: 6252001
description:
[2025-12-23 15:19:00 +0530] info [cpaneld] 70.171.204.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.229.132.218
country_id: 6252001
description:
[2025-12-23 15:19:04 +0530] info [whostmgrd] 138.229.132.218 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.23.71
country_id: 6252001
description:
[2025-12-23 15:19:07 +0530] info [cpaneld] 45.17.23.71 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.136.157
country_id: 6252001
description:
[2025-12-23 15:19:06 +0530] info [cpaneld] 97.170.136.157 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.17.69
country_id: 6252001
description:
[2025-12-23 15:19:05 +0530] info [cpaneld] 76.34.17.69 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.129.193.127
country_id: 6252001
description:
[2025-12-23 15:19:03 +0530] info [cpaneld] 69.129.193.127 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.162.161.243
country_id: 6252001
description:
[2025-12-23 15:19:02 +0530] info [cpaneld] 104.162.161.243 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-23 15:20:06 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:34840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-23 15:20:36 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:40684: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.113
country_id: 2542007
description:
2025-12-23 15:20:36 dovecot_login authenticator failed for H=([105.73.203.113]) [105.73.203.113]:36909: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 15:22:05 host2 sshd[776439]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-23 15:21:18 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:50068: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-23 15:22:44 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:39236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-23 15:22:54 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:37892: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-23 15:23:12 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:59542: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-23 15:23:18 dovecot_login authenticator failed for H=([125.21.7.97]) [128.185.229.126]:42636: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.128.184.28
country_id: 6252001
description:
[2025-12-23 15:28:01 +0530] info [cpaneld] 66.128.184.28 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.40.136
country_id: 6252001
description:
[2025-12-23 15:28:02 +0530] info [cpaneld] 23.241.40.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.148.218.124
country_id: 6252001
description:
[2025-12-23 15:28:03 +0530] info [cpaneld] 35.148.218.124 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.107.140
country_id: 6252001
description:
[2025-12-23 15:28:04 +0530] info [whostmgrd] 173.68.107.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.173.139.151
country_id: 6252001
description:
[2025-12-23 15:28:05 +0530] info [cpaneld] 71.173.139.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.207.59.43
country_id: 6252001
description:
[2025-12-23 15:28:06 +0530] info [cpaneld] 162.207.59.43 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.130.130.239
country_id: 6252001
description:
[2025-12-23 15:28:08 +0530] info [cpaneld] 64.130.130.239 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-12-23 15:29:40 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 15:33:33 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58047: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.253.229.214
country_id: 6252001
description:
Dec 23 15:33:51 host2 pure-ftpd[788977]: (?@192.253.229.214) [INFO] New connection from 192.253.229.214


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 23 15:38:57 host2 sshd[793520]: Disconnected from invalid user admin 152.32.218.149 port 57874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec 23 15:39:30 host2 sshd[793993]: Disconnected from invalid user test3 201.249.205.94 port 33386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-12-23 15:40:13 dovecot_login authenticator failed for H=(nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:54670: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-23 15:40:31 dovecot_login authenticator failed for H=([27.123.119.219]) [182.95.226.118]:50530: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:41:09 host2 sshd[795975]: Disconnected from invalid user admin 103.98.176.164 port 49650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:41:45 host2 sshd[796572]: Disconnected from invalid user west 103.98.176.164 port 56574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 23 15:42:20 host2 sshd[797169]: Disconnected from invalid user testadmin 103.98.176.164 port 51250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.205.94
country_id: 3625428
description:
Dec 23 15:43:00 host2 sshd[797740]: Disconnected from invalid user user 201.249.205.94 port 49068 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 15:44:17 host2 pure-ftpd[799193]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-23 15:49:04 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:44194: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-23 15:48:41 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:46067: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-23 15:48:59 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:53704: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-23 15:49:34 dovecot_login authenticator failed for H=(pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:51878: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:49:50 host2 sshd[805844]: Disconnected from invalid user opscode 103.243.27.122 port 55778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 23 15:51:23 host2 sshd[807892]: Disconnected from invalid user vicente 137.184.30.179 port 53966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:51:49 host2 sshd[808314]: Disconnected from invalid user abel 146.190.112.196 port 37930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-23 15:51:52 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [179.185.18.67]:40448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:51:53 host2 sshd[808365]: Disconnected from invalid user testftp 103.243.27.122 port 55140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.168.135.187
country_id: 1643084
description:
Dec 23 15:51:55 host2 sshd[808418]: Disconnected from invalid user jay 103.168.135.187 port 44630 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 23 15:52:31 host2 sshd[809224]: Disconnected from invalid user benoit 103.243.27.122 port 39262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:54:41 host2 sshd[812147]: Disconnected from invalid user tsbot 146.190.112.196 port 38534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:55:31 host2 sshd[813303]: Disconnected from invalid user carlos1 172.190.42.55 port 33646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:55:52 host2 sshd[813627]: Disconnected from invalid user gogs 146.190.112.196 port 43202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Dec 23 15:56:26 host2 sshd[814143]: Disconnected from invalid user toro 146.190.112.196 port 53042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 23 15:56:39 host2 sshd[814336]: Disconnected from invalid user toto 137.184.30.179 port 37970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:56:46 host2 sshd[814431]: Disconnected from invalid user cynthia 172.190.42.55 port 39176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.59.187
country_id: 290557
description:
Dec 23 15:56:58 host2 sshd[814592]: Disconnected from invalid user ansible 20.203.59.187 port 54382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.42.55
country_id: 6252001
description:
Dec 23 15:57:23 host2 sshd[815007]: Disconnected from invalid user benoit 172.190.42.55 port 54128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.59.187
country_id: 290557
description:
Dec 23 15:57:38 host2 sshd[815229]: Disconnected from invalid user matt 20.203.59.187 port 56634 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 23 16:00:13 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=80.82.77.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EoVuB5xGYOpQUk3K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-23 16:08:43 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:57580: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-23 16:09:00 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:57912: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 16:09:54 host2 sshd[827793]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-23 16:11:53 dovecot_login authenticator failed for H=(92.62.243.175.fibermax.bg) [92.62.243.175]:39393: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.102.101.248
country_id: 1269750
description:
Dec 23 16:12:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=14.102.101.248, lip=66.85.158.91, TLS, session=<0YnNMJxGvcAOZmX4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.140
country_id: 2300660
description:
Dec 23 16:12:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<gihan>, method=PLAIN, rip=41.139.0.140, lip=66.85.158.91, TLS, session=<thVsMpxGxLMpiwCM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-23 16:12:19 dovecot_login authenticator failed for H=([117.248.201.94]) [117.248.201.94]:44330: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.8.125.130
country_id: 3469034
description:
2025-12-23 16:12:32 dovecot_login authenticator failed for H=([189.8.125.130]) [189.8.125.130]:57253: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.27
country_id: 298795
description:
2025-12-23 16:15:12 dovecot_login authenticator failed for H=([188.59.178.27]) [188.59.178.27]:38167: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-23 16:15:37 dovecot_login authenticator failed for H=(nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:36339: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.51
country_id: 3175395
description:
Dec 23 16:16:39 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.15.171.51, lip=66.85.158.91, TLS, session=<G9EsQZxGMOK5D6sz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.240
country_id: 3469034
description:
Dec 23 16:16:59 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=190.89.137.240, lip=66.85.158.91, TLS, session=<9LNVQpxGX9u+WYnw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-23 16:17:33 dovecot_login authenticator failed for H=([128.185.222.216]) [128.185.242.74]:48250: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-23 16:18:10 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:45023: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.196.4
country_id: 6252001
description:
Dec 23 16:18:32 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.196.4, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zQjqSJxGGOkUasQE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2025-12-23 16:19:34 dovecot_login authenticator failed for H=([127.0.0.1]) [177.236.145.94]:54257: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2025-12-23 16:19:48 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.231.114]:53554: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.52.51
country_id: 2921044
description:
[2025-12-23 16:22:37 +0530] info [webmaild] 178.16.52.51 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-23 16:23:24 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:40389: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-12-23 16:24:40 dovecot_login authenticator failed for H=([38.141.252.55]) [38.141.252.55]:40858: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-23 16:24:57 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:51222: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.8.5.53
country_id: 6252001
description:
[2025-12-23 16:29:22 +0530] info [cpaneld] 99.8.5.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.66.224.47
country_id: 6252001
description:
[2025-12-23 16:29:25 +0530] info [cpaneld] 99.66.224.47 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.57.16.238
country_id: 6252001
description:
[2025-12-23 16:29:24 +0530] info [whostmgrd] 104.57.16.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.56.217
country_id: 6252001
description:
[2025-12-23 16:29:27 +0530] info [cpaneld] 74.132.56.217 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.82.34.218
country_id: 6252001
description:
[2025-12-23 16:29:26 +0530] info [cpaneld] 73.82.34.218 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.105.33.168
country_id: 6252001
description:
[2025-12-23 16:29:18 +0530] info [cpaneld] 70.105.33.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.23.61.229
country_id: 6252001
description:
[2025-12-23 16:29:23 +0530] info [cpaneld] 184.23.61.229 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-12-23 16:40:25 dovecot_login authenticator failed for H=111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:50319: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-23 16:40:43 dovecot_login authenticator failed for H=([46.212.111.48]) [46.212.111.48]:37526: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-23 16:41:40 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:44128: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-23 16:42:03 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:56750: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.112.85
country_id: 3469034
description:
Dec 23 16:44:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=177.87.112.85, lip=66.85.158.91, TLS, session=<xtZNpJxGGbmxV3BV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.127
country_id: 3175395
description:
Dec 23 16:44:42 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.139.180.127, lip=66.85.158.91, TLS, session=<anSCpZxG2si5i7R/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 16:46:40 host2 pure-ftpd[865130]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-23 16:54:20 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:55280: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-23 16:54:57 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:45916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-23 16:57:12 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:38009: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-23 16:57:34 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:51104: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.178.165
country_id: 6252001
description:
Dec 23 16:58:39 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.249.178.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5bpo2JxGGrxK+bKl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.58.186.189
country_id: 6252001
description:
[2025-12-23 16:59:06 +0530] info [webmaild] 199.58.186.189 - info@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-12-23 17:02:17 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:55694: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-23 17:02:50 dovecot_login authenticator failed for H=([182.79.70.81]) [27.123.97.74]:53710: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Dec 23 17:16:00 host2 pure-ftpd[897311]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 17:17:15 host2 sshd[898757]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-23 17:20:10 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:39668: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-23 17:20:24 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:41764: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-23 17:21:06 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:54896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 17:21:34 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:54509: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2025-12-23 17:23:43 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:55963: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Dec 23 17:24:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QjyTM51Glg7BJf1d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-12-23 17:24:11 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:50719: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-23 17:24:44 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:48250: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.115.201.137
country_id: 6252001
description:
[2025-12-23 17:27:10 +0530] info [cpaneld] 23.115.201.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.91.244.69
country_id: 6252001
description:
[2025-12-23 17:27:14 +0530] info [whostmgrd] 173.91.244.69 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.161.229
country_id: 6252001
description:
[2025-12-23 17:27:13 +0530] info [cpaneld] 76.176.161.229 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.94.85.50
country_id: 6252001
description:
[2025-12-23 17:27:16 +0530] info [cpaneld] 97.94.85.50 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.37.227.28
country_id: 6252001
description:
[2025-12-23 17:27:17 +0530] info [cpaneld] 47.37.227.28 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-23 17:26:47 dovecot_login authenticator failed for H=31-151-70-150.dynamic.upc.nl [31.151.70.150]:44427: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.231.27.63
country_id: 6252001
description:
[2025-12-23 17:27:11 +0530] info [cpaneld] 104.231.27.63 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.11.48.208
country_id: 6252001
description:
[2025-12-23 17:27:20 +0530] info [cpaneld] 24.11.48.208 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-23 17:27:23 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:55590: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-23 17:27:54 dovecot_login authenticator failed for H=([189.109.154.54]) [189.109.154.54]:42393: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-12-23 17:28:02 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:33056: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.223.8
country_id: 798544
description:
Dec 23 17:33:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=213.92.223.8, lip=66.85.158.91, TLS, session=<9cE4U51GlobVXN8I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 17:34:07 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<L/QSV51GeKXBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-23 17:33:25 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:57575: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.108.55
country_id: 3469034
description:
Dec 23 17:33:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.224.108.55, lip=66.85.158.91, TLS, session=<YRdgVJ1GZ6m64Gw3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-23 17:33:56 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:40446: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 23 17:35:41 host2 sshd[915281]: Disconnected from invalid user bot1 51.38.98.14 port 59336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:35:57 host2 sshd[915458]: Disconnected from invalid user nexus 50.37.231.46 port 40708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:36:04 host2 sshd[915556]: Disconnected from invalid user mapr 190.129.122.185 port 48070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.39
country_id: 3469034
description:
Dec 23 17:36:08 host2 sshd[915609]: Disconnected from invalid user sunil 189.8.108.39 port 58908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 23 17:36:15 host2 sshd[915664]: Disconnected from invalid user sftptest 51.38.98.14 port 46444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:36:48 host2 sshd[915970]: Disconnected from invalid user python 190.129.122.185 port 38920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.39
country_id: 3469034
description:
Dec 23 17:36:52 host2 sshd[916033]: Disconnected from invalid user jitendra 189.8.108.39 port 34920 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.78
country_id: 2635167
description:
Dec 23 17:37:19 host2 dovecot[3805015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.78, lip=66.85.158.91, TLS, session=<+82pYp1Gtcu594lO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:36:31 host2 sshd[915843]: Disconnected from invalid user sunil 50.37.231.46 port 51632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 23 17:37:31 host2 sshd[916508]: Disconnected from invalid user rabbitmq 190.129.122.185 port 56474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.37.231.46
country_id: 6252001
description:
Dec 23 17:37:42 host2 sshd[916671]: Disconnected from invalid user mapr 50.37.231.46 port 40366 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.94.135.131
country_id: 6252001
description:
[2025-12-23 17:39:07 +0530] info [whostmgrd] 66.94.135.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.251.161.33
country_id: 6252001
description:
[2025-12-23 17:39:08 +0530] info [cpaneld] 69.251.161.33 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.9.110
country_id: 6252001
description:
[2025-12-23 17:39:09 +0530] info [cpaneld] 73.170.9.110 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.56.160.112
country_id: 6252001
description:
[2025-12-23 17:39:11 +0530] info [cpaneld] 134.56.160.112 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.249.52.45
country_id: 6252001
description:
[2025-12-23 17:39:02 +0530] info [cpaneld] 71.249.52.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.60.7
country_id: 6252001
description:
[2025-12-23 17:39:04 +0530] info [cpaneld] 172.56.60.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.113.183.72
country_id: 6252001
description:
[2025-12-23 17:39:05 +0530] info [cpaneld] 99.113.183.72 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-12-23 17:41:45 dovecot_login authenticator failed for H=(ws99-36-153-203.rcil.gov.in) [182.72.143.2]:41886: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-23 17:42:20 dovecot_login authenticator failed for H=(189.219.138.45-clientes-izzi.mx) [189.219.138.45]:44353: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 17:49:10 host2 pure-ftpd[927490]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-23 17:51:43 dovecot_login authenticator failed for H=([110.49.147.210]) [110.49.147.210]:42914: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-23 17:51:57 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:55104: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-23 17:54:17 dovecot_login authenticator failed for H=([103.140.18.186]) [103.140.18.186]:53242: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.27
country_id: 1522867
description:
2025-12-23 17:54:30 dovecot_login authenticator failed for H=([212.116.247.27]) [212.116.247.27]:47482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 17:55:16 host2 sshd[932661]: Disconnected from invalid user hadoop 139.59.26.79 port 54264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-23 17:57:12 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:53890: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.65
country_id: 2542007
description:
2025-12-23 17:56:49 dovecot_login authenticator failed for H=([105.73.190.65]) [105.73.190.65]:34254: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 17:58:28 host2 sshd[935371]: Disconnected from invalid user admin 101.36.117.148 port 42896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-23 17:59:14 dovecot_login authenticator failed for H=(201.172.88.155-clientes-izzi.mx) [201.172.88.155]:40600: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 23 18:00:08 host2 sshd[936253]: Disconnected from invalid user admin2 27.111.32.174 port 50586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:00:16 host2 sshd[936353]: Disconnected from invalid user admin 139.59.26.79 port 37142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-23 17:59:44 dovecot_login authenticator failed for H=([196.190.43.138]) [196.190.41.137]:31125: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 18:00:27 host2 sshd[936560]: Disconnected from invalid user dcadmin 101.36.117.148 port 58700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:00:35 host2 sshd[936624]: Disconnected from invalid user design 45.78.223.101 port 57598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-23 18:00:54 dovecot_login authenticator failed for H=([213.32.253.235]) [213.32.253.235]:55257: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:00:56 host2 sshd[936899]: Disconnected from invalid user git 139.59.26.79 port 35710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 23 18:02:02 host2 sshd[937730]: Disconnected from invalid user mcbserver 27.111.32.174 port 60884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 23 18:01:33 host2 sshd[937326]: Disconnected from invalid user robot 139.59.26.79 port 58262 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 23 18:01:37 host2 sshd[937369]: Disconnected from invalid user admin 101.36.117.148 port 60164 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.201.71.44
country_id: 6252001
description:
[2025-12-23 18:03:55 +0530] info [cpaneld] 71.201.71.44 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.144.82
country_id: 6252001
description:
[2025-12-23 18:03:58 +0530] info [cpaneld] 76.32.144.82 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.14.152.72
country_id: 6252001
description:
[2025-12-23 18:03:57 +0530] info [cpaneld] 76.14.152.72 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.130.2.46
country_id: 6252001
description:
[2025-12-23 18:03:48 +0530] info [cpaneld] 74.130.2.46 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.111.104.2
country_id: 6252001
description:
[2025-12-23 18:03:50 +0530] info [cpaneld] 73.111.104.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.2.55.83
country_id: 6252001
description:
[2025-12-23 18:03:51 +0530] info [cpaneld] 160.2.55.83 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.143.28.201
country_id: 6252001
description:
[2025-12-23 18:03:54 +0530] info [whostmgrd] 69.143.28.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:05:14 host2 sshd[940601]: Disconnected from invalid user test 45.78.223.101 port 51588 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 18:05:30 host2 sshd[940958]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-23 18:06:29 dovecot_login authenticator failed for H=([207.219.221.53]) [207.219.221.53]:52091: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-23 18:06:47 dovecot_login authenticator failed for H=(cm-178.232.126.146.get.no) [178.232.126.146]:56721: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-23 18:07:35 dovecot_login authenticator failed for H=(beta.corporatecitizen.in) [103.29.235.44]:36344: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-12-23 18:07:58 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:60084: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 18:08:29 host2 sshd[942874]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 23 18:08:33 host2 sshd[942904]: Disconnected from invalid user gitlab 45.78.223.101 port 44144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec 23 18:09:20 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<13wn1Z1Gav4t4/6b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-23 18:09:28 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([127.0.0.1]) [62.103.27.217]:54088: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2025-12-23 18:09:55 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.228.106]:40882: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.181.57
country_id: 6252001
description:
Dec 23 18:17:24 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.181.57, lip=66.85.158.91, TLS, session=<JrMM8p1GuN2l47U5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-23 18:19:05 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:36630: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2025-12-23 18:19:23 dovecot_login authenticator failed for H=(nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:46094: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-23 18:21:54 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:57648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2025-12-23 18:22:41 dovecot_login authenticator failed for H=([49.124.151.57]) [49.124.151.57]:51538: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.97.118
country_id: 3469034
description:
Dec 23 18:31:10 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=167.249.97.118, lip=66.85.158.91, TLS, session=<hi8kIp5GGbSn+WF2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.99
country_id: 953987
description:
Dec 23 18:31:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.54.99, lip=66.85.158.91, TLS, session=<kNdnI55G9qNmgTZj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.27.7
country_id: 933860
description:
Dec 23 18:35:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=83.143.27.7, lip=66.85.158.91, TLS, session=<NwEPM55GY9VTjxsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.211
country_id: 6290252
description:
Dec 23 18:36:14 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=109.207.35.211, lip=66.85.158.91, TLS, session=<W01qNJ5GBKhtzyPT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.15.87.157
country_id: 6252001
description:
[2025-12-23 18:39:23 +0530] info [cpaneld] 24.15.87.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.249.126.252
country_id: 6252001
description:
[2025-12-23 18:39:31 +0530] info [cpaneld] 98.249.126.252 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.252.6.93
country_id: 6252001
description:
[2025-12-23 18:39:32 +0530] info [cpaneld] 67.252.6.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.134.28.74
country_id: 6252001
description:
[2025-12-23 18:39:25 +0530] info [cpaneld] 72.134.28.74 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.7.84
country_id: 6252001
description:
[2025-12-23 18:39:27 +0530] info [cpaneld] 76.90.7.84 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.74.63.10
country_id: 6252001
description:
[2025-12-23 18:39:28 +0530] info [whostmgrd] 174.74.63.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.9.20.106
country_id: 6252001
description:
[2025-12-23 18:39:30 +0530] info [cpaneld] 24.9.20.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.113.225.118
country_id: 6252001
description:
[2025-12-23 18:43:36 +0530] info [cpaneld] 68.113.225.118 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.250.135.104
country_id: 6252001
description:
[2025-12-23 18:43:37 +0530] info [cpaneld] 108.250.135.104 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.121.104.14
country_id: 6252001
description:
[2025-12-23 18:43:38 +0530] info [cpaneld] 24.121.104.14 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.71.203.169
country_id: 6252001
description:
[2025-12-23 18:43:30 +0530] info [cpaneld] 75.71.203.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.188.242.176
country_id: 6252001
description:
[2025-12-23 18:43:31 +0530] info [cpaneld] 47.188.242.176 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.184.189.48
country_id: 6252001
description:
[2025-12-23 18:43:33 +0530] info [cpaneld] 184.184.189.48 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.237.155
country_id: 6252001
description:
[2025-12-23 18:43:34 +0530] info [whostmgrd] 76.168.237.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.21
country_id: 798549
description:
Dec 23 18:48:15 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.21, lip=66.85.158.92, session=<7f1eYJ5GOr9V2ZUV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 18:51:48 host2 pure-ftpd[979063]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:51:58 host2 sshd[979251]: Disconnected from invalid user postgres 162.241.87.197 port 37574 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.241.155.116
country_id: 6252001
description:
Dec 23 18:54:57 host2 pure-ftpd[983194]: (?@192.241.155.116) [INFO] New connection from 192.241.155.116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.241.155.116
country_id: 6252001
description:
Dec 23 18:54:56 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=192.241.155.116, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gqc/eJ5G1OnA8Zt0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-23 18:55:58 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-23 18:56:17 dovecot_login authenticator failed for H=(cm-178.232.201.31.get.no) [178.232.201.31]:38144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:56:18 host2 sshd[984922]: Disconnected from invalid user dev 162.241.87.197 port 36434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:56:55 host2 sshd[985497]: Disconnected from invalid user minecraft 162.241.87.197 port 43700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec 23 18:57:32 host2 sshd[986132]: Disconnected from invalid user jenkins 162.241.87.197 port 39506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.228.161.66
country_id: 1327865
description:
Dec 23 18:57:38 host2 sshd[986147]: Disconnected from invalid user ethan 136.228.161.66 port 58482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Dec 23 18:59:42 host2 sshd[987879]: Disconnected from invalid user factorio 94.102.4.12 port 43664 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.102.4.12
country_id: 298795
description:
Dec 23 19:00:24 host2 sshd[988650]: Disconnected from invalid user user11 94.102.4.12 port 57396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2025-12-23 19:00:48 dovecot_login authenticator failed for H=([87.200.93.86]) [87.200.93.86]:46309: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 23 19:00:56 host2 sshd[989009]: Disconnected from invalid user usertest 160.251.197.41 port 57530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 19:01:48 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57469: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.197.73.147
country_id: 2661886
description:
Dec 23 19:02:19 host2 sshd[989915]: Disconnected from invalid user vncuser 82.197.73.147 port 45486 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.197.73.147
country_id: 2661886
description:
Dec 23 19:03:28 host2 sshd[990852]: Disconnected from invalid user user11 82.197.73.147 port 39006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 23 19:05:04 host2 sshd[992513]: Disconnected from invalid user vnc 160.251.197.41 port 37078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.76.135.162
country_id: 6252001
description:
2025-12-23 19:06:01 dovecot_login authenticator failed for H=149-76-135-162.fidnet.com [149.76.135.162]:53114: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-23 19:06:22 dovecot_login authenticator failed for H=([65.20.187.47]) [65.20.187.47]:58895: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.87
country_id: 1643084
description:
Dec 23 19:07:24 host2 sshd[995171]: Disconnected from invalid user qwe 103.23.199.87 port 39294 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-23 19:07:32 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:33300: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-23 19:07:46 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:33345: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.174.85
country_id: 1643084
description:
2025-12-23 19:11:04 dovecot_login authenticator failed for H=([36.92.174.85]) [36.92.174.85]:55021: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-23 19:11:16 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:34379: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 19:13:17 host2 sshd[1001389]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-23 19:12:27 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:41416: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.170.45
country_id: 6252001
description:
Dec 23 19:12:57 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.170.45, lip=66.85.158.91, session=<Z8GquJ5GppgofKot>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.220.144
country_id: 2921044
description:
Dec 23 19:14:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=68.183.220.144, lip=66.85.158.92, session=<MJxovp5G/RNEt9yQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.115.140
country_id: 2921044
description:
Dec 23 19:14:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.115.140, lip=66.85.158.92, session=<yypuvp5GCG4uZXOM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-23 19:15:01 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:43676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-23 19:15:26 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:49386: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-23 19:18:35 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:51534: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.197.28
country_id: 2542007
description:
2025-12-23 19:19:29 dovecot_login authenticator failed for H=([105.73.197.28]) [105.73.197.28]:37399: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.12.22.249
country_id: 6252001
description:
Dec 23 19:25:20 host2 pure-ftpd[1010510]: (?@154.12.22.249) [INFO] New connection from 154.12.22.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.0.164.73
country_id: 3508796
description:
2025-12-23 19:30:15 dovecot_login authenticator failed for H=([127.0.0.1]) [148.0.164.73]:41665: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 23 19:31:06 host2 pure-ftpd[1015480]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.67.53
country_id: 6252001
description:
2025-12-23 19:30:31 dovecot_login authenticator failed for H=([127.0.0.1]) [136.228.67.53]:54154: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.25
country_id: 2510769
description:
Dec 23 19:31:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=139.28.190.25, lip=66.85.158.91, TLS, session=<1ZKt+Z5Gj6yLHL4Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.16
country_id: 6252001
description:
Dec 23 19:31:31 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.16, lip=66.85.158.92, session=<pR8T+55GjtkUQcIQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 23 19:31:40 host2 pure-ftpd[1015784]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.150
country_id: 3865483
description:
Dec 23 19:31:47 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.252.150, lip=66.85.158.91, TLS, session=<cvfd+p5GtumzAPyW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.209
country_id: 953987
description:
Dec 23 19:36:16 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=102.129.63.209, lip=66.85.158.91, TLS, session=<wizaCp9G88ZmgT/R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.27.7
country_id: 933860
description:
Dec 23 19:36:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=83.143.27.7, lip=66.85.158.91, TLS, session=<Mp0yDJ9GlOxTjxsH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.185.120.213
country_id: 130758
description:
Dec 23 19:37:17 host2 sshd[1020135]: Disconnected from invalid user m 85.185.120.213 port 51250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 23 19:37:53 host2 sshd[1020731]: Disconnected from invalid user iview 85.185.120.213 port 47234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-23 19:43:42 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:42516: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-12-23 19:43:57 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:38334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-23 19:45:38 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:39200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-23 19:45:56 dovecot_login authenticator failed for H=(nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:34830: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.225.30.41
country_id: 241170
description:
Dec 23 19:51:26 host2 pure-ftpd[1031727]: (?@156.225.30.41) [INFO] New connection from 156.225.30.41


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.244.187
country_id: 1880251
description:
Dec 23 19:51:52 host2 sshd[1032018]: Disconnected from invalid user git 43.160.244.187 port 51652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Dec 23 19:51:57 host2 sshd[1032081]: Disconnected from invalid user pzserver 45.164.39.253 port 38848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-12-23 19:52:30 dovecot_login authenticator failed for H=([182.95.222.186]) [182.95.222.186]:39624: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.146.253
country_id: 2750405
description:
Dec 23 19:52:47 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=161.35.146.253, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<MUElR59GFoChI5L9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-23 19:53:03 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:52580: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.244.187
country_id: 1880251
description:
Dec 23 19:53:53 host2 sshd[1033518]: Disconnected from invalid user root1 43.160.244.187 port 59230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.160.244.187
country_id: 1880251
description:
Dec 23 19:54:34 host2 sshd[1034352]: Disconnected from invalid user sysadmin 43.160.244.187 port 45464 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 19:54:36 host2 pure-ftpd[1034384]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 23 19:55:05 host2 sshd[1034773]: Disconnected from invalid user t128 141.145.147.99 port 35434 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.104.141
country_id: 6252001
description:
Dec 23 19:55:23 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.104.141, lip=66.85.158.91, session=<9aVuUJ9GoMihI2iN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 23 19:56:59 host2 sshd[1036431]: Disconnected from invalid user webadmin 102.88.137.80 port 1063 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 23 19:57:27 host2 sshd[1036848]: Disconnected from invalid user shyam 62.97.44.51 port 55444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.14.28
country_id: 1668284
description:
Dec 23 19:57:32 host2 sshd[1036936]: Disconnected from invalid user nishant 165.154.14.28 port 48058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 23 19:58:28 host2 sshd[1037993]: Disconnected from invalid user bayu 102.88.137.80 port 1029 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Dec 23 20:01:15 host2 sshd[1041661]: Disconnected from invalid user nishant 45.164.39.253 port 53444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 23 20:00:26 host2 sshd[1041010]: Disconnected from invalid user git 141.145.147.99 port 34846 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 23 20:02:20 host2 sshd[1042613]: Received disconnect from 62.97.44.51 port 36034:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.14.28
country_id: 1668284
description:
Dec 23 20:01:30 host2 sshd[1041871]: Disconnected from invalid user noroot 165.154.14.28 port 43660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-12-23 20:04:38 dovecot_login authenticator failed for H=(static.bb.btd.59.99.153.21.bsnl.in) [59.99.153.21]:45860: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-23 20:04:47 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:40892: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.192.162
country_id: 732800
description:
[2025-12-23 20:05:20 +0530] info [webmaild] 185.94.192.162 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.104.141
country_id: 6252001
description:
Dec 23 20:08:55 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=161.35.104.141, lip=66.85.158.92, session=<3nzVgJ9GJtChI2iN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.145.147.99
country_id: 290557
description:
Dec 23 20:11:13 host2 sshd[1050625]: Disconnected from invalid user test1 141.145.147.99 port 38640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2025-12-23 20:20:44 dovecot_login authenticator failed for H=([125.19.164.187]) [125.19.162.102]:57798: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.132
country_id: 6252001
description:
Dec 23 20:26:28 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.132, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wi2dv59Gf6xb5qiE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.238
country_id: 6252001
description:
Dec 23 20:26:31 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.238, lip=66.85.158.92, TLS: Connection closed, session=<E4LLv59Gy9lb5qju>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.0.66.89
country_id: 6252001
description:
[2025-12-23 20:26:36 +0530] info [cpaneld] 68.0.66.89 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.134
country_id: 6252001
description:
Dec 23 20:26:11 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.134, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GH+Zvp9GZ8Rb5qiG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.131
country_id: 6252001
description:
Dec 23 20:26:23 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.230.168.131, lip=66.85.158.92, TLS: Connection closed, session=<251Jv59GDepb5qiD>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 20:26:45 host2 sshd[1064022]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.153.141.87
country_id: 6252001
description:
[2025-12-23 20:26:41 +0530] info [cpaneld] 99.153.141.87 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.151.166.199
country_id: 6252001
description:
[2025-12-23 20:26:43 +0530] info [cpaneld] 24.151.166.199 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.55.203.128
country_id: 6252001
description:
[2025-12-23 20:26:46 +0530] info [cpaneld] 99.55.203.128 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.203.120.31
country_id: 6252001
description:
[2025-12-23 20:26:39 +0530] info [cpaneld] 170.203.120.31 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.207.28.245
country_id: 6252001
description:
[2025-12-23 20:26:38 +0530] info [cpaneld] 107.207.28.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.183.0.171
country_id: 6252001
description:
[2025-12-23 20:26:40 +0530] info [whostmgrd] 24.183.0.171 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Dec 23 20:29:00 host2 sshd[1065294]: Disconnected from invalid user git 68.183.93.67 port 52684 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.227
country_id: 6252001
description:
Dec 23 20:29:09 host2 pure-ftpd[1065476]: (?@64.62.197.227) [INFO] New connection from 64.62.197.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.72.59
country_id: 3996063
description:
2025-12-23 20:29:11 dovecot_login authenticator failed for H=(201.173.72.59-clientes-izzi.mx) [201.173.72.59]:41320: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-12-23 20:29:25 dovecot_login authenticator failed for H=([182.95.131.41]) [103.251.31.166]:35118: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.53
country_id: 6252001
description:
Dec 23 20:29:29 host2 pure-ftpd[1065674]: (?@167.94.146.53) [INFO] New connection from 167.94.146.53


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.37
country_id: 3923057
description:
Dec 23 20:30:37 host2 sshd[1067036]: Disconnected from invalid user localuser 190.181.27.37 port 53960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.15
country_id: 933860
description:
Dec 23 20:32:36 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<info>, method=PLAIN, rip=41.216.213.15, lip=66.85.158.91, TLS, session=<y97c059Gd9Up2NUP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.158
country_id: 3865483
description:
Dec 23 20:32:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=45.238.106.158, lip=66.85.158.91, TLS, session=<s7ZY0p9GuJkt7mqe>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.37
country_id: 3923057
description:
Dec 23 20:32:07 host2 sshd[1068081]: Disconnected from invalid user ubuntu 190.181.27.37 port 51850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Dec 23 20:33:09 host2 sshd[1068807]: Disconnected from invalid user cloud 68.183.93.67 port 58278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.93.67
country_id: 1269750
description:
Dec 23 20:33:50 host2 sshd[1069231]: Disconnected from invalid user guest 68.183.93.67 port 39114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-23 20:35:36 dovecot_login authenticator failed for H=([203.124.60.46]) [203.124.60.46]:39632: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-23 20:35:50 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:44366: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.77
country_id: 732800
description:
Dec 23 20:37:15 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.253.159.77, lip=66.85.158.91, TLS, session=<0tIj5Z9G6rm5/Z9N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.137
country_id: 3277605
description:
Dec 23 20:36:46 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=188.246.73.137, lip=66.85.158.91, TLS, session=</Gtv459G7Ai89kmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-12-23 20:38:13 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:37556: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.178
country_id: 3017382
description:
Dec 23 20:39:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.178, lip=66.85.158.92, TLS handshaking: Connection closed, session=<To8i7Z9Gl8tbxJiy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.213
country_id: 3017382
description:
Dec 23 20:39:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.213, lip=66.85.158.92, TLS: Connection closed, session=<qDDW7Z9GY4hbxJjV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.179
country_id: 3017382
description:
Dec 23 20:39:30 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.179, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7dc37p9GXYhbxJiz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.208
country_id: 3017382
description:
Dec 23 20:39:33 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.208, lip=66.85.158.92, TLS: Connection closed, session=<OcJn7p9GQ4ZbxJjQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-23 20:38:44 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:52725: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-23 20:39:03 dovecot_login authenticator failed for H=069.138.48.116.static.netvigator.com [116.48.138.69]:53446: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-23 20:41:45 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:41100: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.95.157.171
country_id: 1861060
description:
Dec 23 20:43:01 host2 sshd[1077006]: Disconnected from invalid user db2fenc1 150.95.157.171 port 42120 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.9.4.81
country_id: 6252001
description:
[2025-12-23 20:44:47 +0530] info [cpaneld] 70.9.4.81 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.95.90.160
country_id: 6252001
description:
[2025-12-23 20:44:49 +0530] info [whostmgrd] 73.95.90.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.9.118
country_id: 6252001
description:
[2025-12-23 20:44:52 +0530] info [cpaneld] 47.157.9.118 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.53.72.109
country_id: 6252001
description:
[2025-12-23 20:44:53 +0530] info [cpaneld] 50.53.72.109 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.213.63
country_id: 6252001
description:
[2025-12-23 20:44:54 +0530] info [cpaneld] 96.241.213.63 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.34.3.58
country_id: 6252001
description:
[2025-12-23 20:44:44 +0530] info [cpaneld] 68.34.3.58 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.231.40.245
country_id: 6252001
description:
[2025-12-23 20:44:47 +0530] info [cpaneld] 73.231.40.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.23.172.153
country_id: 6252001
description:
Dec 23 20:47:18 host2 sshd[1081219]: Disconnected from invalid user wg 154.23.172.153 port 61782 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.2.94.14
country_id: 6252001
description:
[2025-12-23 20:49:29 +0530] info [cpaneld] 96.2.94.14 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.252.58.100
country_id: 6252001
description:
[2025-12-23 20:49:31 +0530] info [whostmgrd] 108.252.58.100 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.41.120
country_id: 6252001
description:
[2025-12-23 20:49:33 +0530] info [cpaneld] 76.90.41.120 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.117.101.214
country_id: 6252001
description:
[2025-12-23 20:49:32 +0530] info [cpaneld] 97.117.101.214 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.85.173.185
country_id: 6252001
description:
[2025-12-23 20:49:34 +0530] info [cpaneld] 73.85.173.185 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.171.228.74
country_id: 6252001
description:
[2025-12-23 20:49:24 +0530] info [cpaneld] 97.171.228.74 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.28.121.7
country_id: 6252001
description:
[2025-12-23 20:49:28 +0530] info [cpaneld] 38.28.121.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-23 20:50:47 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:34650: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-23 20:51:07 dovecot_login authenticator failed for H=(200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:55795: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2025-12-23 20:51:57 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:56959: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec 23 20:52:04 host2 sshd[1085607]: Disconnected from invalid user user1 52.250.16.220 port 36254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-23 20:52:47 dovecot_login authenticator failed for H=static-213-130-207-177.cust.tele2.lt [213.130.207.177]:50552: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.250.16.220
country_id: 6252001
description:
Dec 23 20:53:12 host2 sshd[1086668]: Disconnected from invalid user pankaj 52.250.16.220 port 53938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec 23 20:53:49 host2 sshd[1087224]: Disconnected from invalid user nadmin 52.250.16.220 port 57190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Dec 23 20:55:06 host2 sshd[1089041]: Disconnected from invalid user exam 52.250.16.220 port 44672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 23 20:56:20 host2 sshd[1090478]: Disconnected from invalid user gitlab-runner 103.250.10.42 port 34728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-23 20:56:31 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:42782: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-23 20:57:01 dovecot_login authenticator failed for H=([207.219.221.101]) [207.219.221.101]:37090: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 20:57:30 host2 pure-ftpd[1091863]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.77
country_id: 2510769
description:
Dec 23 20:57:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=139.28.190.77, lip=66.85.158.91, TLS, session=<Pz6PLaBGzo2LHL5N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.14
country_id: 798544
description:
Dec 23 20:57:50 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.231.121.14, lip=66.85.158.91, TLS, session=<n7bILqBG7IJb53kO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 23 20:57:55 host2 sshd[1092281]: Disconnected from invalid user teamtalk 103.250.10.42 port 39472 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.109.120.208
country_id: 6252001
description:
[2025-12-23 21:01:09 +0530] info [cpaneld] 143.109.120.208 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.211.180.157
country_id: 6252001
description:
[2025-12-23 21:01:13 +0530] info [cpaneld] 76.211.180.157 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.134.38
country_id: 6252001
description:
[2025-12-23 21:01:06 +0530] info [cpaneld] 45.31.134.38 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.60.181.138
country_id: 6252001
description:
[2025-12-23 21:01:07 +0530] info [cpaneld] 104.60.181.138 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.131.125.235
country_id: 6252001
description:
[2025-12-23 21:01:11 +0530] info [cpaneld] 97.131.125.235 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 23 21:00:54 host2 sshd[1095499]: Disconnected from invalid user postgres 36.255.223.75 port 63214 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.62.45.163
country_id: 6252001
description:
[2025-12-23 21:01:04 +0530] info [cpaneld] 68.62.45.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.42.134.29
country_id: 6252001
description:
[2025-12-23 21:01:08 +0530] info [whostmgrd] 68.42.134.29 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.5.135
country_id: 6252001
description:
Dec 23 21:02:09 host2 sshd[1096655]: Disconnected from invalid user nexus 165.227.5.135 port 43920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 23 21:02:31 host2 sshd[1097126]: Disconnected from invalid user ubuntu 200.69.236.207 port 56637 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.159.132.213
country_id: 2921044
description:
Dec 23 21:01:52 host2 sshd[1096366]: Disconnected from invalid user deep 34.159.132.213 port 37810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.159.132.213
country_id: 2921044
description:
Dec 23 21:03:40 host2 sshd[1098220]: Disconnected from invalid user ftpuser 34.159.132.213 port 49398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 23 21:04:31 host2 sshd[1098980]: Disconnected from invalid user ubuntu 200.69.236.207 port 44758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.159.132.213
country_id: 2921044
description:
Dec 23 21:04:52 host2 sshd[1099305]: Disconnected from invalid user testuser 34.159.132.213 port 35386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 23 21:05:19 host2 sshd[1099796]: Disconnected from invalid user git 200.69.236.207 port 51661 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 23 21:06:20 host2 sshd[1100601]: Disconnected from invalid user ttbot 36.255.223.75 port 43090 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.154
country_id: 1880251
description:
Dec 23 21:07:05 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=94.231.206.154, lip=66.85.158.92, session=<oLHeUKBGc7Ne586a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.152
country_id: 1880251
description:
Dec 23 21:07:27 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.152, lip=66.85.158.92, session=<cHIuUqBG96Ze586Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.5.135
country_id: 6252001
description:
Dec 23 21:06:52 host2 sshd[1101013]: Disconnected from invalid user git 165.227.5.135 port 52108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.204
country_id: 1880251
description:
Dec 23 21:07:16 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.204, lip=66.85.158.92, session=<sAOEUaBGCcFe587M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.159.132.213
country_id: 2921044
description:
Dec 23 21:06:39 host2 sshd[1100805]: Disconnected from invalid user jarservice 34.159.132.213 port 50554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.136
country_id: 6252001
description:
Dec 23 21:06:41 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.136, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LmVqT6BGx8Wi2JaI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.31.53
country_id: 6252001
description:
2025-12-23 21:06:49 dovecot_login authenticator failed for H=(maximsholdings.com) [45.83.31.53]:50450: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.105
country_id: 1814991
description:
Dec 23 21:08:08 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=94.231.206.105, lip=66.85.158.92, session=<5FqVVKBGF8pe585p>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.5.135
country_id: 6252001
description:
Dec 23 21:08:07 host2 sshd[1102178]: Disconnected from invalid user jimmy 165.227.5.135 port 59950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.33
country_id: 1814991
description:
Dec 23 21:08:18 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.33, lip=66.85.158.92, session=<yzY4VaBGD4Ve584h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.110
country_id: 1814991
description:
Dec 23 21:08:32 host2 dovecot[3805015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.110, lip=66.85.158.92, session=<gLAPVqBGT8Re585u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.104
country_id: 1814991
description:
Dec 23 21:08:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.104, lip=66.85.158.92, session=<xkZEVqBGD6Re585o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.136
country_id: 6252001
description:
Dec 23 21:07:40 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=162.216.150.136, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<JkfwUqBGwOai2JaI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec 23 21:08:49 host2 sshd[1103069]: Disconnected from invalid user admin 36.255.223.75 port 36978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-23 21:08:51 dovecot_login authenticator failed for H=([65.20.143.159]) [65.20.143.159]:49051: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-23 21:09:09 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:55794: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.5.135
country_id: 6252001
description:
Dec 23 21:08:38 host2 sshd[1102885]: Disconnected from invalid user sammy 165.227.5.135 port 55814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.136
country_id: 6252001
description:
Dec 23 21:12:02 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.136, lip=66.85.158.92, TLS, session=<FlWIYqBGaP2i2JaI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 21:14:58 host2 sshd[1109059]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.53.113
country_id: 6252001
description:
[2025-12-23 21:17:58 +0530] info [cpaneld] 70.170.53.113 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.26.90
country_id: 6252001
description:
[2025-12-23 21:18:00 +0530] info [cpaneld] 65.185.26.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.72.96.107
country_id: 6252001
description:
[2025-12-23 21:18:03 +0530] info [cpaneld] 68.72.96.107 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.200.157.8
country_id: 6252001
description:
[2025-12-23 21:18:04 +0530] info [whostmgrd] 47.200.157.8 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.122.67
country_id: 6252001
description:
[2025-12-23 21:18:05 +0530] info [cpaneld] 47.158.122.67 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.173.61.168
country_id: 6252001
description:
[2025-12-23 21:18:07 +0530] info [cpaneld] 173.173.61.168 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.71.100.102
country_id: 6252001
description:
[2025-12-23 21:18:08 +0530] info [cpaneld] 208.71.100.102 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-23 21:21:40 dovecot_login authenticator failed for H=(177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:49481: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-23 21:22:08 dovecot_login authenticator failed for H=([149.54.15.42]) [149.54.15.42]:48863: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.80.103
country_id: 1269750
description:
Dec 23 21:23:13 host2 sshd[1116677]: Disconnected from invalid user mediamanager_playerssistemas 68.183.80.103 port 60926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.80.103
country_id: 1269750
description:
Dec 23 21:24:10 host2 sshd[1117472]: Disconnected from invalid user mediamanager_playerssistemas 68.183.80.103 port 32806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.80.103
country_id: 1269750
description:
Dec 23 21:24:46 host2 sshd[1117948]: Disconnected from invalid user syntex_websyntex 68.183.80.103 port 41774 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Dec 23 21:29:05 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VCiKn6BGi9Wi2JZ8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Dec 23 21:29:42 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<Yxy2oaBGEvqi2JZ8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.147.162.215
country_id: 3686110
description:
Dec 23 21:30:17 host2 sshd[1123453]: Disconnected from invalid user sshtunnel 186.147.162.215 port 44456 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.131.42
country_id: 6252001
description:
Dec 23 21:32:17 host2 sshd[1125366]: Disconnected from invalid user testuser 198.46.131.42 port 49760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.131.42
country_id: 6252001
description:
Dec 23 21:32:52 host2 sshd[1125888]: Disconnected from invalid user develop 198.46.131.42 port 34000 [preauth]


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 23 21:35:17 host2 dovecot[1133349]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Dec 23 21:35:01 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS, session=<H4DFtKBGXPii2JZ8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.252.157.122
country_id: 1643084
description:
Dec 23 21:36:50 host2 sshd[1135196]: Disconnected from invalid user es 180.252.157.122 port 35442 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.225
country_id: 6252001
description:
Dec 23 21:37:30 host2 pure-ftpd[1135795]: (?@198.235.24.225) [INFO] New connection from 198.235.24.225


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 23 21:40:16 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<bXmLx6BGDvW4affD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.252.157.122
country_id: 1643084
description:
Dec 23 21:40:08 host2 sshd[1137621]: Disconnected from invalid user arun 180.252.157.122 port 52518 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 23 21:40:44 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<aEMuyaBGQvC4affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-23 21:42:45 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:46168: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-23 21:43:08 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:39904: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Dec 23 21:45:36 host2 sshd[1140621]: Disconnected from invalid user user10 212.11.64.164 port 46802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.208
country_id: 3865483
description:
Dec 23 21:45:49 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=186.190.167.208, lip=66.85.158.91, TLS, session=<mdY52qBGRN+6vqfQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.10.196.106
country_id: 3469034
description:
Dec 23 21:46:09 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=177.10.196.106, lip=66.85.158.91, TLS, session=<aJOJ26BGapixCsRq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.102.191.51
country_id: 2589581
description:
2025-12-23 21:47:16 dovecot_plain authenticator failed for H=(V4836VC8A) [41.102.191.51]:52186: 535 Incorrect authentication data (set_id=virajith.rathnasekara@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.147.162.215
country_id: 3686110
description:
Dec 23 21:46:52 host2 sshd[1141364]: Disconnected from invalid user sinusbot 186.147.162.215 port 38004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-23 21:48:20 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:42450: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-23 21:48:34 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:59954: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Dec 23 21:48:42 host2 sshd[1142516]: Disconnected from invalid user mapadmin 212.11.64.164 port 47094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-23 21:48:46 dovecot_login authenticator failed for H=([128.185.235.110]) [128.185.235.110]:42098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-12-23 21:49:06 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:47970: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-23 21:49:44 +0530] info [cpaneld] 89.249.55.106 - dataesit "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Dec 23 21:49:51 host2 sshd[1143219]: Disconnected from invalid user hadoop 212.11.64.164 port 40054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.11.64.164
country_id: 241170
description:
Dec 23 21:50:24 host2 sshd[1143908]: Disconnected from invalid user joel 212.11.64.164 port 53834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 23 21:52:51 host2 sshd[1145530]: Disconnected from invalid user user1 165.154.200.14 port 56284 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 23 21:55:16 host2 sshd[1147626]: Disconnected from invalid user ftpuser 165.154.200.14 port 52418 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.94.85.169
country_id: 6252001
description:
[2025-12-23 21:55:59 +0530] info [cpaneld] 71.94.85.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.197.135.173
country_id: 6252001
description:
[2025-12-23 21:56:07 +0530] info [cpaneld] 73.197.135.173 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.97.161.169
country_id: 6252001
description:
[2025-12-23 21:56:03 +0530] info [cpaneld] 152.97.161.169 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.13.41
country_id: 6252001
description:
[2025-12-23 21:56:05 +0530] info [whostmgrd] 47.147.13.41 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.170.244
country_id: 6252001
description:
[2025-12-23 21:56:06 +0530] info [cpaneld] 172.59.170.244 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.176.223.84
country_id: 6252001
description:
[2025-12-23 21:56:10 +0530] info [cpaneld] 75.176.223.84 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.228.75.15
country_id: 6252001
description:
[2025-12-23 21:56:02 +0530] info [cpaneld] 68.228.75.15 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 22:00:24 host2 pure-ftpd[1155248]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-12-23 22:02:33 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:45362: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 193.149.189.234
country_id: 2635167
description:
Dec 23 22:02:21 host2 pure-ftpd[1166046]: (?@193.149.189.234) [INFO] New connection from 193.149.189.234


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.133.147.134
country_id: 6252001
description:
[2025-12-23 22:03:34 +0530] info [cpaneld] 69.133.147.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.27.35
country_id: 6252001
description:
[2025-12-23 22:03:35 +0530] info [cpaneld] 76.90.27.35 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.166.27.103
country_id: 6252001
description:
[2025-12-23 22:03:36 +0530] info [whostmgrd] 98.166.27.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.116.118.22
country_id: 6252001
description:
[2025-12-23 22:03:32 +0530] info [cpaneld] 73.116.118.22 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.133.126.200
country_id: 6252001
description:
[2025-12-23 22:03:37 +0530] info [cpaneld] 73.133.126.200 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.188.137
country_id: 6252001
description:
[2025-12-23 22:03:36 +0530] info [cpaneld] 71.38.188.137 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.184.111.142
country_id: 6252001
description:
[2025-12-23 22:03:38 +0530] info [cpaneld] 72.184.111.142 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 23 22:04:45 host2 sshd[1167599]: Disconnected from invalid user ociisprd 158.174.210.161 port 21063 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.8.84.144
country_id: 6252001
description:
[2025-12-23 22:05:16 +0530] info [cpaneld] 100.8.84.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.150.33
country_id: 6252001
description:
[2025-12-23 22:05:18 +0530] info [cpaneld] 76.141.150.33 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.228.59.75
country_id: 6252001
description:
[2025-12-23 22:05:19 +0530] info [whostmgrd] 71.228.59.75 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.6.91
country_id: 6252001
description:
[2025-12-23 22:05:20 +0530] info [cpaneld] 35.151.6.91 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.198.52
country_id: 6252001
description:
[2025-12-23 22:05:23 +0530] info [cpaneld] 172.89.198.52 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.174.30.196
country_id: 6252001
description:
[2025-12-23 22:05:17 +0530] info [cpaneld] 192.174.30.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.162.212.139
country_id: 6252001
description:
[2025-12-23 22:05:21 +0530] info [cpaneld] 70.162.212.139 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 23 22:07:18 host2 sshd[1169450]: Disconnected from invalid user vpn 158.174.210.161 port 49769 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Dec 23 22:08:29 host2 sshd[1170550]: Disconnected from invalid user tv 188.166.104.136 port 43868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 23 22:08:33 host2 sshd[1170594]: Disconnected from invalid user work 103.191.14.210 port 49390 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 23 22:09:12 host2 sshd[1171132]: Disconnected from invalid user kamal 158.174.210.161 port 57829 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-23 22:09:28 dovecot_login authenticator failed for H=(nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:49584: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Dec 23 22:10:23 host2 sshd[1172258]: Disconnected from invalid user prueba 188.166.104.136 port 44110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 23 22:11:58 host2 sshd[1173411]: Disconnected from invalid user backend 158.174.210.161 port 48226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Dec 23 22:12:21 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.59, lip=66.85.158.91, TLS: Connection closed, session=<8s48OqFGfH6nXpI7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 23 22:14:10 host2 sshd[1175652]: Disconnected from invalid user ftpuser 165.154.205.128 port 52594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 23 22:13:49 host2 sshd[1175297]: Disconnected from invalid user bg 103.191.14.210 port 59274 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 23 22:16:27 host2 sshd[1177803]: Disconnected from invalid user aaa 103.191.14.210 port 35426 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.53.160
country_id: 6252001
description:
[2025-12-23 22:16:29 +0530] info [cpaneld] 65.185.53.160 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.38.194.110
country_id: 6252001
description:
[2025-12-23 22:16:36 +0530] info [cpaneld] 76.38.194.110 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.228.39.11
country_id: 6252001
description:
[2025-12-23 22:16:35 +0530] info [cpaneld] 162.228.39.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.117.158.84
country_id: 6252001
description:
[2025-12-23 22:16:38 +0530] info [cpaneld] 172.117.158.84 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.68.10
country_id: 6252001
description:
[2025-12-23 22:16:37 +0530] info [whostmgrd] 69.181.68.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.90.228.161
country_id: 6252001
description:
[2025-12-23 22:16:40 +0530] info [cpaneld] 207.90.228.161 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.144.101
country_id: 6252001
description:
[2025-12-23 22:16:39 +0530] info [cpaneld] 35.150.144.101 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 23 22:17:20 host2 sshd[1178869]: Disconnected from invalid user ubuntu 198.98.56.205 port 59818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 23 22:19:02 host2 sshd[1180095]: Disconnected from invalid user alex 198.98.56.205 port 48816 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.187.73.152
country_id: 6252001
description:
[2025-12-23 22:19:02 +0530] info [cpaneld] 24.187.73.152 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.254.16
country_id: 6252001
description:
[2025-12-23 22:18:54 +0530] info [cpaneld] 129.222.254.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.193.94.106
country_id: 6252001
description:
[2025-12-23 22:18:55 +0530] info [cpaneld] 64.193.94.106 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.87.131.165
country_id: 6252001
description:
[2025-12-23 22:18:58 +0530] info [whostmgrd] 97.87.131.165 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.90.79.155
country_id: 6252001
description:
[2025-12-23 22:19:01 +0530] info [cpaneld] 75.90.79.155 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.80.247.131
country_id: 6252001
description:
[2025-12-23 22:18:57 +0530] info [cpaneld] 108.80.247.131 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.2.140.203
country_id: 6252001
description:
[2025-12-23 22:19:00 +0530] info [cpaneld] 172.2.140.203 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-23 22:19:47 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:34118: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-23 22:20:02 dovecot_login authenticator failed for H=([59.98.144.36]) [59.98.144.36]:33632: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 22:22:19 host2 sshd[1182902]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.159.21.71
country_id: 6252001
description:
[2025-12-23 22:23:15 +0530] info [webmaild] 45.159.21.71 - info@melanifinefood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.220.195.133
country_id: 2017370
description:
[2025-12-23 22:24:09 +0530] info [webmaild] 77.220.195.133 - info@ceylondigest.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Dec 23 22:25:40 host2 sshd[1185824]: Disconnected from invalid user bg 188.166.104.136 port 44394 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.202.12.11
country_id: 294640
description:
[2025-12-23 22:25:47 +0530] info [webmaild] 193.202.12.11 - info@secondcoffeeinternational.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.211.129.82
country_id: 6252001
description:
Dec 23 22:26:41 host2 pure-ftpd[1186550]: (?@54.211.129.82) [INFO] New connection from 54.211.129.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-23 22:29:24 dovecot_login authenticator failed for H=([103.163.44.118]) [103.163.44.118]:59232: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-23 22:29:28 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:41086: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-23 22:29:40 dovecot_login authenticator failed for H=92.40.62.72.threembb.co.uk [92.40.62.72]:55526: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-23 22:29:44 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:55117: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-23 22:30:20 dovecot_login authenticator failed for H=([149.54.15.42]) [149.54.15.42]:33437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-23 22:31:26 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:37955: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 23 22:34:24 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, session=<dj0aiaFG9HS4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.252
country_id: 6252001
description:
Dec 23 22:34:50 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.252, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Su6viqFGpMm4aff8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Dec 23 22:34:51 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, session=<uKC9iqFGtHe4affD>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.149.206.34
country_id: 6252001
description:
[2025-12-23 22:36:52 +0530] info [cpaneld] 98.149.206.34 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.11.245.80
country_id: 6252001
description:
[2025-12-23 22:36:54 +0530] info [cpaneld] 99.11.245.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.196.24.38
country_id: 6252001
description:
[2025-12-23 22:36:56 +0530] info [cpaneld] 72.196.24.38 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.115.101.27
country_id: 6252001
description:
[2025-12-23 22:36:58 +0530] info [cpaneld] 68.115.101.27 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.210.121.164
country_id: 6252001
description:
[2025-12-23 22:36:57 +0530] info [whostmgrd] 107.210.121.164 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.174.220.18
country_id: 6252001
description:
[2025-12-23 22:37:00 +0530] info [cpaneld] 99.174.220.18 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.212.135.253
country_id: 6252001
description:
[2025-12-23 22:37:01 +0530] info [cpaneld] 98.212.135.253 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.33.184.143
country_id: 6252001
description:
[2025-12-23 22:41:09 +0530] info [whostmgrd] 162.33.184.143 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.226.23.224
country_id: 6252001
description:
[2025-12-23 22:41:10 +0530] info [cpaneld] 131.226.23.224 - kamechotechcom "GET /login/?login_only=1&user=kamechotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.70.98.24
country_id: 6252001
description:
[2025-12-23 22:41:12 +0530] info [cpaneld] 73.70.98.24 - kamechot "GET /login/?login_only=1&user=kamechot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.21.212
country_id: 6252001
description:
[2025-12-23 22:41:19 +0530] info [cpaneld] 74.244.21.212 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.226.154.72
country_id: 6252001
description:
[2025-12-23 22:41:21 +0530] info [cpaneld] 75.226.154.72 - kamecho2 "GET /login/?login_only=1&user=kamecho2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.173.207
country_id: 6252001
description:
[2025-12-23 22:41:05 +0530] info [cpaneld] 71.202.173.207 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.170.101.50
country_id: 6252001
description:
[2025-12-23 22:41:07 +0530] info [cpaneld] 148.170.101.50 - kamechotech "GET /login/?login_only=1&user=kamechotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamechotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.57.19.81
country_id: 6252001
description:
[2025-12-23 22:41:18 +0530] info [cpaneld] 204.57.19.81 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.200.169
country_id: 6252001
description:
[2025-12-23 22:41:13 +0530] info [cpaneld] 172.89.200.169 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.21.168.169
country_id: 6252001
description:
[2025-12-23 22:41:14 +0530] info [cpaneld] 38.21.168.169 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.33.128.82
country_id: 6252001
description:
[2025-12-23 22:41:16 +0530] info [cpaneld] 73.33.128.82 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.141.174
country_id: 6252001
description:
[2025-12-23 22:41:06 +0530] info [cpaneld] 104.32.141.174 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.55.162.234
country_id: 6252001
description:
[2025-12-23 22:41:15 +0530] info [cpaneld] 184.55.162.234 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.207.199.13
country_id: 6252001
description:
[2025-12-23 22:41:20 +0530] info [cpaneld] 98.207.199.13 - kamecho1 "GET /login/?login_only=1&user=kamecho1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-23 22:42:11 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:44200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-23 22:42:38 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:52015: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.92
country_id: 6252001
description:
Dec 23 22:43:18 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.92, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PhruqKFGdMIs3Llc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.155.165.37
country_id: 6252001
description:
[2025-12-23 22:46:06 +0530] info [cpaneld] 24.155.165.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.44.201.33
country_id: 6252001
description:
[2025-12-23 22:46:04 +0530] info [cpaneld] 24.44.201.33 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.102.171
country_id: 6252001
description:
[2025-12-23 22:46:11 +0530] info [cpaneld] 73.151.102.171 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.192.100.130
country_id: 6252001
description:
[2025-12-23 22:46:12 +0530] info [cpaneld] 98.192.100.130 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.8.146.20
country_id: 6252001
description:
[2025-12-23 22:46:17 +0530] info [cpaneld] 73.8.146.20 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.194.251
country_id: 6252001
description:
[2025-12-23 22:46:19 +0530] info [cpaneld] 73.170.194.251 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.93.125.53
country_id: 6252001
description:
[2025-12-23 22:46:08 +0530] info [cpaneld] 64.93.125.53 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.59.186.119
country_id: 6252001
description:
[2025-12-23 22:46:11 +0530] info [cpaneld] 108.59.186.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.52.52.248
country_id: 6252001
description:
[2025-12-23 22:46:12 +0530] info [cpaneld] 136.52.52.248 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.210.80.2
country_id: 6252001
description:
[2025-12-23 22:46:14 +0530] info [cpaneld] 24.210.80.2 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.205.10.98
country_id: 6252001
description:
[2025-12-23 22:46:16 +0530] info [cpaneld] 68.205.10.98 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.124.66.188
country_id: 6252001
description:
[2025-12-23 22:46:09 +0530] info [whostmgrd] 73.124.66.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.36.251.124
country_id: 6252001
description:
[2025-12-23 22:46:13 +0530] info [cpaneld] 50.36.251.124 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.67.17.122
country_id: 6252001
description:
[2025-12-23 22:46:15 +0530] info [whostmgrd] 99.67.17.122 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.136.92
country_id: 2963597
description:
Dec 23 22:47:22 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=89.106.136.92, lip=66.85.158.91, TLS, session=<5BaLtqFGZeFZaohc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 22:47:20 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56899: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.50
country_id: 6252001
description:
Dec 23 22:48:38 host2 pure-ftpd[1201932]: (?@205.210.31.50) [INFO] New connection from 205.210.31.50


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.248
country_id: 3865483
description:
Dec 23 22:47:44 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=190.181.90.248, lip=66.85.158.91, TLS, session=<iteot6FG+Jq+tVr4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.140.209.83
country_id: 6252001
description:
[2025-12-23 22:50:21 +0530] info [cpaneld] 107.140.209.83 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.111.148
country_id: 6252001
description:
[2025-12-23 22:50:25 +0530] info [whostmgrd] 97.170.111.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.233.74
country_id: 6252001
description:
[2025-12-23 22:50:23 +0530] info [cpaneld] 76.175.233.74 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.92.106
country_id: 6252001
description:
[2025-12-23 22:50:26 +0530] info [cpaneld] 172.56.92.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.115.6.173
country_id: 6252001
description:
[2025-12-23 22:50:28 +0530] info [cpaneld] 71.115.6.173 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.14.46
country_id: 6252001
description:
[2025-12-23 22:50:27 +0530] info [cpaneld] 71.202.14.46 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.227.184.194
country_id: 6252001
description:
[2025-12-23 22:50:22 +0530] info [cpaneld] 66.227.184.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.233
country_id: 2635167
description:
Dec 23 22:52:35 host2 dovecot[1133416]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.233, lip=66.85.158.91, TLS, session=<6vwjyqFG05C594np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.77
country_id: 2635167
description:
Dec 23 22:52:36 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.77, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DJ41yqFGT8+594lN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.92
country_id: 2635167
description:
Dec 23 22:53:09 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.92, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<AwAxzKFGnblX7LBc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Dec 23 22:53:42 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<N3QszqFGS8FX7LBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.87
country_id: 2635167
description:
Dec 23 22:54:16 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.87, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<mMsn0KFGU5W594lX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.75
country_id: 2635167
description:
Dec 23 22:54:49 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.75, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<8S0j0qFGYYO594lL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.86
country_id: 2635167
description:
Dec 23 22:55:22 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.86, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Q54c1KFGF7tX7LBW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.106.231
country_id: 1269750
description:
Dec 23 22:55:28 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.87.106.231, lip=66.85.158.91, TLS, session=<Ye5i06FGLodnV2rn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-23 22:55:35 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:45214: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.67
country_id: 3175395
description:
Dec 23 22:55:46 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.67, lip=66.85.158.91, TLS, session=<itCJ1KFGs+i5xQlD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-23 22:55:57 dovecot_login authenticator failed for H=(cm-178.232.147.85.get.no) [178.232.147.85]:43106: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.81
country_id: 2635167
description:
Dec 23 22:55:55 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.81, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<zw4a1qFGS9S594lR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.75
country_id: 2635167
description:
Dec 23 22:56:29 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.75, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<4VIV2KFGQ9O594lL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.103
country_id: 2635167
description:
Dec 23 22:57:35 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.103, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<ARoK3KFGJ4lX7LBn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.74
country_id: 2635167
description:
Dec 23 22:57:02 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.74, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<i7gO2qFGE85X7LBK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-12-23 22:57:51 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:59432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-23 22:58:04 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:43522: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-23 22:58:57 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:55095: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-23 22:59:45 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:49889: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.71
country_id: 6252001
description:
Dec 23 23:00:09 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.71, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xr085aFGW61BMQFH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Dec 23 23:00:26 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PeU05qFGJFNBMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Dec 23 23:00:41 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS: Connection closed, session=<+3AY56FGvi9BMQFC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 23:03:08 host2 pure-ftpd[1216026]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 23:10:23 host2 sshd[1223544]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 23:11:04 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<2oUjDKJGorPBHmEh>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.233.220.43
country_id: 6252001
description:
[2025-12-23 23:12:49 +0530] info [webmaild] 193.233.220.43 - info@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-23 23:14:43 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:42029: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.152
country_id: 1643084
description:
Dec 23 23:14:51 host2 sshd[1227807]: Disconnected from invalid user vivek 103.13.206.152 port 57068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2025-12-23 23:15:16 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:48312: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.152
country_id: 1643084
description:
Dec 23 23:15:37 host2 sshd[1228670]: Disconnected from invalid user arthur 103.13.206.152 port 42628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.152
country_id: 1643084
description:
Dec 23 23:16:59 host2 sshd[1229455]: Disconnected from invalid user kibana 103.13.206.152 port 54808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 23 23:18:15 host2 sshd[1230323]: Disconnected from invalid user git 202.165.22.246 port 49488 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-23 23:18:29 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:39350: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 23 23:20:34 host2 sshd[1232299]: Disconnected from invalid user admin 202.165.22.246 port 58822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 23 23:21:52 host2 sshd[1233250]: Disconnected from invalid user frappe 202.165.22.246 port 58234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-23 23:22:10 dovecot_login authenticator failed for H=([152.52.234.170]) [182.95.177.78]:47880: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 23 23:22:21 host2 sshd[1233560]: Disconnected from invalid user mgeweb 45.78.225.21 port 59846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-23 23:22:33 dovecot_login authenticator failed for H=([128.185.223.87]) [182.95.178.154]:41644: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 23 23:23:10 host2 sshd[1234156]: Disconnected from invalid user ovpn 181.116.220.11 port 49611 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 23 23:24:22 host2 sshd[1235079]: Disconnected from invalid user tmp 181.116.220.11 port 54366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 23 23:28:31 host2 sshd[1238409]: Disconnected from invalid user opc 45.78.225.21 port 47902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 23 23:29:47 host2 sshd[1239259]: Disconnected from invalid user myuser 45.78.225.21 port 43924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:33:25 host2 sshd[1242423]: Disconnected from invalid user huawei 41.74.172.237 port 33768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 23 23:35:05 host2 sshd[1243890]: Disconnected from invalid user apps 158.69.204.92 port 46600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:36:15 host2 sshd[1244981]: Disconnected from invalid user test 41.74.172.237 port 45182 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.66.208.108
country_id: 2017370
description:
[2025-12-23 23:36:23 +0530] info [webmaild] 45.66.208.108 - info@weeratrading.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 23 23:37:06 host2 sshd[1245621]: Disconnected from invalid user thomas 158.69.204.92 port 43684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 23 23:38:35 host2 sshd[1246695]: Disconnected from invalid user test 158.69.204.92 port 40296 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 23 23:39:34 host2 sshd[1247779]: Received disconnect from 158.69.204.92 port 44690:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:39:49 host2 sshd[1248004]: Disconnected from invalid user mark 41.74.172.237 port 60346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:41:20 host2 sshd[1249839]: Disconnected from invalid user usher 41.74.172.237 port 39588 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.134.140.229
country_id: 6252001
description:
[2025-12-23 23:42:12 +0530] info [webmaild] 45.134.140.229 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.74.172.237
country_id: 49518
description:
Dec 23 23:42:42 host2 sshd[1251070]: Disconnected from invalid user z 41.74.172.237 port 38340 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.35.34.168
country_id: 6252001
description:
[2025-12-23 23:44:25 +0530] info [cpaneld] 98.35.34.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.180.42
country_id: 6252001
description:
[2025-12-23 23:44:28 +0530] info [cpaneld] 47.147.180.42 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.5.166.73
country_id: 6252001
description:
[2025-12-23 23:44:32 +0530] info [cpaneld] 107.5.166.73 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.29.171.226
country_id: 6252001
description:
[2025-12-23 23:44:34 +0530] info [cpaneld] 108.29.171.226 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.237
country_id: 6252001
description:
Dec 23 23:44:35 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.237, lip=66.85.158.91, session=<gSAghKJGd9xAPsXt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.23.68.156
country_id: 6252001
description:
[2025-12-23 23:44:29 +0530] info [whostmgrd] 70.23.68.156 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.43.167.9
country_id: 6252001
description:
[2025-12-23 23:44:33 +0530] info [cpaneld] 50.43.167.9 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.184.224.82
country_id: 6252001
description:
[2025-12-23 23:44:26 +0530] info [cpaneld] 192.184.224.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Dec 23 23:44:46 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.91, TLS: Connection closed, session=<2n/DhKJGJIhAPsXj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.234
country_id: 3996063
description:
2025-12-23 23:54:22 dovecot_login authenticator failed for H=(201.173.216.234-clientes-izzi.mx) [201.173.216.234]:37317: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.232.107
country_id: 294640
description:
[2025-12-23 23:57:40 +0530] info [webmaild] 45.148.232.107 - info@kiriaswanu.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.20.157.103
country_id: 6252001
description:
[2025-12-24 00:03:21 +0530] info [cpaneld] 174.20.157.103 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.169.114.248
country_id: 6252001
description:
[2025-12-24 00:03:22 +0530] info [whostmgrd] 184.169.114.248 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.8.147.213
country_id: 6252001
description:
[2025-12-24 00:03:26 +0530] info [cpaneld] 76.8.147.213 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.16.131
country_id: 3865483
description:
Dec 24 00:03:35 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.117.16.131, lip=66.85.158.91, TLS, session=<yf4Bx6JG1oOKdRCD>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.90.251.231
country_id: 6252001
description:
[2025-12-24 00:03:25 +0530] info [cpaneld] 97.90.251.231 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.121.132.56
country_id: 6252001
description:
[2025-12-24 00:03:30 +0530] info [cpaneld] 64.121.132.56 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.18
country_id: 1269750
description:
Dec 24 00:03:15 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.237.58.18, lip=66.85.158.91, TLS, session=<GVC/xaJGGMVn7ToS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.194.65.184
country_id: 6252001
description:
[2025-12-24 00:03:18 +0530] info [cpaneld] 76.194.65.184 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.43
country_id: 6252001
description:
[2025-12-24 00:03:20 +0530] info [cpaneld] 172.58.167.43 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.16.20.103
country_id: 6252001
description:
[2025-12-24 00:06:30 +0530] info [whostmgrd] 24.16.20.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.160.98.186
country_id: 6252001
description:
[2025-12-24 00:06:32 +0530] info [cpaneld] 70.160.98.186 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.29.157.192
country_id: 6252001
description:
[2025-12-24 00:06:35 +0530] info [cpaneld] 50.29.157.192 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 00:05:45 host2 pure-ftpd[1275961]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.211.239.76
country_id: 6252001
description:
[2025-12-24 00:06:26 +0530] info [cpaneld] 72.211.239.76 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.240.253.203
country_id: 6252001
description:
[2025-12-24 00:06:25 +0530] info [cpaneld] 70.240.253.203 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.102.152.71
country_id: 6252001
description:
[2025-12-24 00:06:27 +0530] info [cpaneld] 50.102.152.71 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-24 00:08:09 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:58846: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.34
country_id: 1269750
description:
Dec 24 00:08:25 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=103.30.83.34, lip=66.85.158.91, TLS, session=<G7JA2KJGa45nHlMi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.85
country_id: 6252001
description:
Dec 24 00:08:36 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.85, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gNME2qJG+tLG6xhV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-24 00:07:46 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:59465: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.53
country_id: 1269750
description:
Dec 24 00:08:04 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=103.18.166.53, lip=66.85.158.91, TLS, session=<PZfx1qJGQrVnEqY1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.173.180.62
country_id: 6252001
description:
[2025-12-24 00:09:03 +0530] info [cpaneld] 73.173.180.62 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.16.226
country_id: 6252001
description:
[2025-12-24 00:09:06 +0530] info [cpaneld] 73.41.16.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.196.179.117
country_id: 6252001
description:
[2025-12-24 00:09:09 +0530] info [whostmgrd] 151.196.179.117 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.73.177.202
country_id: 6252001
description:
[2025-12-24 00:09:07 +0530] info [cpaneld] 71.73.177.202 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.44.186.208
country_id: 6252001
description:
[2025-12-24 00:09:11 +0530] info [cpaneld] 73.44.186.208 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.14.136
country_id: 6252001
description:
[2025-12-24 00:09:14 +0530] info [cpaneld] 47.154.14.136 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.35.141.6
country_id: 6252001
description:
[2025-12-24 00:09:13 +0530] info [cpaneld] 24.35.141.6 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 24 00:10:21 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, session=<e3tJ4KJGwt9KUi8F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-24 00:10:26 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:43111: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.147
country_id: 6252001
description:
Dec 24 00:10:34 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.147, lip=66.85.158.92, TLS handshaking: Connection closed, session=<67MJ4aJG4ahBMQGT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 24 00:10:50 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, session=<MX/64aJGUjVKUi8F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Dec 24 00:10:52 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<BJ4Z4qJGEnRBMQGO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-24 00:10:59 dovecot_login authenticator failed for H=([135.13.8.246]) [74.224.215.23]:9796: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 00:17:13 host2 sshd[1286125]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.36
country_id: 1819730
description:
Dec 24 00:29:26 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.36, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<uaCIJKNGbLktjpok>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.84.219.189
country_id: 6252001
description:
[2025-12-24 00:29:56 +0530] info [cpaneld] 71.84.219.189 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.251.44.5
country_id: 6252001
description:
[2025-12-24 00:29:43 +0530] info [cpaneld] 162.251.44.5 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.53.172.238
country_id: 6252001
description:
[2025-12-24 00:29:51 +0530] info [cpaneld] 24.53.172.238 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.220.75.144
country_id: 6252001
description:
[2025-12-24 00:29:48 +0530] info [cpaneld] 97.220.75.144 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.34.80.152
country_id: 6252001
description:
[2025-12-24 00:29:50 +0530] info [whostmgrd] 136.34.80.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.145.204.190
country_id: 6252001
description:
[2025-12-24 00:29:54 +0530] info [cpaneld] 73.145.204.190 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.36
country_id: 1819730
description:
Dec 24 00:29:28 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.36, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<F5mnJKNGPr8tjpok>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.37.44.175
country_id: 6252001
description:
[2025-12-24 00:29:41 +0530] info [cpaneld] 136.37.44.175 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 00:34:20 host2 sshd[1299419]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.249
country_id: 6252001
description:
Dec 24 00:34:20 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.249, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ISgNNqNGudnG6xj5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.118.3
country_id: 3017382
description:
Dec 24 00:35:56 host2 sshd[1301114]: Disconnected from invalid user ubuntu 141.95.118.3 port 53548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.217.192
country_id: 6252001
description:
Dec 24 00:36:16 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.234.217.192, lip=66.85.158.91, session=<Kv72PKNG6qKs6tnA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.89.240.251
country_id: 1210997
description:
Dec 24 00:37:25 host2 sshd[1302220]: Disconnected from invalid user bodega 103.89.240.251 port 44508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 24 00:36:35 host2 sshd[1301638]: Disconnected from invalid user ubuntu 172.174.72.225 port 36130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.118.3
country_id: 3017382
description:
Dec 24 00:38:55 host2 sshd[1303226]: Disconnected from invalid user rtc 141.95.118.3 port 36316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 24 00:39:05 host2 sshd[1303389]: Disconnected from invalid user webuser 172.174.72.225 port 34872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.89.240.251
country_id: 1210997
description:
Dec 24 00:38:41 host2 sshd[1303092]: Disconnected from invalid user exploit 103.89.240.251 port 54668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.95.118.3
country_id: 3017382
description:
Dec 24 00:40:33 host2 sshd[1304564]: Disconnected from invalid user hadoop 141.95.118.3 port 48542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 24 00:41:55 host2 sshd[1305385]: Disconnected from invalid user exploit 103.186.0.68 port 38042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 24 00:42:38 host2 sshd[1305954]: Disconnected from invalid user loginuser 103.186.0.68 port 56864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.194
country_id: 3469034
description:
Dec 24 00:44:04 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=177.130.170.194, lip=66.85.158.91, TLS, session=<PJS3V6NGu8GxgqrC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.179
country_id: 3469034
description:
Dec 24 00:44:26 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.179, lip=66.85.158.91, TLS, session=<XgMBWaNGp5q+WYiz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-24 00:46:09 dovecot_login authenticator failed for H=(82-102-165-200.orange.net.il) [82.102.165.200]:38136: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-24 00:46:23 dovecot_login authenticator failed for H=([128.185.80.65]) [182.95.52.122]:35044: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-24 00:45:31 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:35526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-24 00:46:04 dovecot_login authenticator failed for H=([189.80.46.250]) [189.80.46.250]:40364: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec 24 00:46:50 host2 sshd[1309253]: Disconnected from invalid user alex 103.186.0.68 port 49388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-24 00:48:13 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:39552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 24 00:47:37 host2 dovecot[1133416]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<CASNZaNG2uLPWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.96
country_id: 3996063
description:
2025-12-24 00:48:32 dovecot_login authenticator failed for H=(201.173.216.96-clientes-izzi.mx) [201.173.216.96]:53324: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-24 00:50:11 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:56076: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-24 00:50:34 dovecot_login authenticator failed for H=([196.28.226.66]) [196.28.226.66]:39054: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 24 01:02:53 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<gN0hnKNGSpxChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 24 01:03:57 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<g6b5nqNG65bJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.144
country_id: 1269750
description:
Dec 24 01:04:17 host2 dovecot[1133416]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=103.213.195.144, lip=66.85.158.91, TLS, session=<egUboKNGBcFn1cOQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 01:04:31 host2 sshd[1326242]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2025-12-24 01:06:56 dovecot_login authenticator failed for H=([127.0.0.1]) [24.232.114.16]:40591: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.91.148.232
country_id: 298795
description:
2025-12-24 01:07:23 dovecot_login authenticator failed for H=([127.0.0.1]) [176.91.148.232]:33374: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 01:08:11 host2 pure-ftpd[1330140]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-24 01:14:21 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:53745: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-12-24 01:14:36 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:37992: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 24.199.97.179
country_id: 6252001
description:
Dec 24 01:18:35 host2 dovecot[1133416]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=24.199.97.179, lip=66.85.158.91, TLS, session=<NxlF1KNG5q4Yx2Gz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.14
country_id: 798549
description:
Dec 24 01:23:31 host2 dovecot[1133416]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=212.73.148.14, lip=66.85.158.91, TLS: Connection closed, session=<04zr5aNG3ovUSZQO>


