# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.218.115
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.239.218.115 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-16 07:31:06 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:44504: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 66.116.204.139
country_id: 1269750
description:
Jan 16 07:31:15 host2 sshd[2110141]: User agentallianz from 66.116.204.139 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.212.54
country_id: 3865483
description:
Jan 16 07:33:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=181.16.212.54, lip=66.85.158.91, TLS, session=<BM+RvXdIp8+1ENQ2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.110.87
country_id: 798544
description:
Jan 16 07:33:36 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=91.196.110.87, lip=66.85.158.91, TLS, session=<itzavndIq+hbxG5X>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 07:42:43 host2 sshd[2119691]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 07:43:43 host2 sshd[2120451]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.106
country_id: 953987
description:
Jan 16 07:46:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.46.106, lip=66.85.158.91, TLS, session=<Cqcm63dIsOBmQC5q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 16 07:45:50 host2 sshd[2122364]: Invalid user agronatureholdings from 143.110.213.247 port 58254


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.238.63.168
country_id: 798544
description:
Jan 16 07:46:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=185.238.63.168, lip=66.85.158.91, TLS, session=<Nm9q7HdIdKa57j+o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.45.235.112
country_id: 2510769
description:
2026-01-16 07:48:43 dovecot_login authenticator failed for H=112.red-83-45-235.dynamicip.rima-tde.net [83.45.235.112]:34018: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2026-01-16 07:48:52 dovecot_login authenticator failed for H=(client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:36344: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.245
country_id: 3017382
description:
Jan 16 07:52:08 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.245, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Wa0ZAnhIj+Bb51n1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.143
country_id: 3017382
description:
Jan 16 07:52:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.143, lip=66.85.158.91, TLS: Connection closed, session=<1By1A3hI56xb51mP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.142
country_id: 3017382
description:
Jan 16 07:52:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.142, lip=66.85.158.91, TLS: Connection closed, session=<5nC6AnhIJ+pb51mO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.140
country_id: 3017382
description:
Jan 16 07:52:32 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.140, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ggaFA3hI+Y1b51mM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.49.113
country_id: 3144096
description:
2026-01-16 07:53:34 dovecot_login authenticator failed for H=(cm-178.232.49.113.get.no) [178.232.49.113]:37184: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-16 07:53:44 dovecot_login authenticator failed for H=([186.239.240.127]) [186.215.245.175]:33876: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.126.172
country_id: 294640
description:
2026-01-16 07:57:11 dovecot_login authenticator failed for H=([46.210.126.172]) [46.210.126.172]:43374: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan 16 07:57:28 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<b/AoFXhInK8DWgzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.208
country_id: 6252001
description:
Jan 16 07:58:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.208, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<nZiVGHhIK9rG6xjQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-16 07:59:12 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:32861: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.93.89.48
country_id: 130758
description:
Jan 16 08:02:28 host2 sshd[2135991]: User agentallianz from 185.93.89.48 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.59.46.198
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 139.59.46.198 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2026-01-16 08:03:41 dovecot_login authenticator failed for H=([122.184.136.185]) [182.95.181.22]:57016: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.61
country_id: 2186224
description:
2026-01-16 08:04:47 dovecot_login authenticator failed for H=([121.73.168.61]) [121.73.168.61]:54444: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.79
country_id: 1733045
description:
2026-01-16 08:05:08 dovecot_login authenticator failed for H=([49.125.201.79]) [49.125.201.79]:46576: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.81.253
country_id: 6252001
description:
Jan 16 08:06:05 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.165.81.253, lip=66.85.158.92, session=<Vy72M3hIRNc0pVH9>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan 16 08:06:11 host2 sshd[2138982]: User agentallianz from 64.225.40.153 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-16 08:07:19 dovecot_plain authenticator failed for H=(quilater) [65.20.133.4]:32798: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 16 08:08:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<6JyhPXhIiNjPWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 16 08:08:47 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<jIWdPXhIhtjPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.230
country_id: 2635167
description:
Jan 16 08:11:11 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.230, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jCYxRnhIh5VX7LDm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.18
country_id: 2635167
description:
Jan 16 08:11:10 host2 dovecot[221878]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.18, lip=66.85.158.91, TLS, session=<oBYgRnhIFbO594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.224
country_id: 2635167
description:
Jan 16 08:11:44 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.224, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kpgsSHhIwb1X7LDg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.127
country_id: 6252001
description:
Jan 16 08:11:45 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.127, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<HJ07SHhIT9Ci2JZ/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.219
country_id: 2635167
description:
Jan 16 08:12:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.219, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<mt4nSnhIs6FX7LDb>


