# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-15 00:16:28 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:35766: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-15 00:16:46 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:10360: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.78
country_id: 6252001
description:
Nov 15 00:17:33 host2 pure-ftpd[4145581]: (?@135.237.125.78) [INFO] New connection from 135.237.125.78


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.66
country_id: 6252001
description:
Nov 15 00:21:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.66, lip=66.85.158.91, TLS: Connection closed, session=<MiavepJDiKbHLZtC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 37.19.200.153
country_id: 6252001
description:
Nov 15 00:24:35 host2 pure-ftpd[4150157]: (?@37.19.200.153) [INFO] New connection from 37.19.200.153


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.22.203
country_id: 1819730
description:
Nov 15 00:29:58 host2 sshd[4153215]: Disconnected from invalid user didi 154.221.22.203 port 50210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.142
country_id: 3077311
description:
2025-11-15 00:30:28 dovecot_login authenticator failed for (ADMIN) [212.102.39.142]:9829: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Nov 15 00:33:32 host2 sshd[4155459]: Disconnected from invalid user dontstarve 154.221.22.203 port 56794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-15 00:34:14 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (glitymon) [73.195.211.98]:32848: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 00:44:54 host2 sshd[4161639]: Disconnected from invalid user  2.57.121.112 port 61718 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.138.167
country_id: 2921044
description:
Nov 15 00:46:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.59.138.167, lip=66.85.158.91, TLS, session=<gOc51JJDCvCLO4qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.40
country_id: 1269750
description:
Nov 15 00:47:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.18.166.40, lip=66.85.158.91, TLS, session=<rNCX15JDONtnEqYo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.107.191
country_id: 3469034
description:
Nov 15 00:47:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=187.85.107.191, lip=66.85.158.91, TLS, session=<QlTg2JJD9ay7VWu/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-15 00:48:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (nonress) [87.103.126.54]:51990: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 00:51:22 host2 sshd[4166950]: Disconnected from invalid user minh 2.57.121.112 port 61960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-15 00:51:39 dovecot_login authenticator failed for ([182.76.108.121]) [182.78.159.82]:36354: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.121
country_id: 3996063
description:
2025-11-15 00:51:57 dovecot_login authenticator failed for ([201.173.216.121]) [201.173.216.121]:41023: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.116
country_id: 2635167
description:
Nov 15 01:02:13 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.116, lip=66.85.158.91, TLS, session=<BM/1DZNDH71X7LB0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 01:03:06 host2 sshd[4173869]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.90.142.216
country_id: 3077311
description:
Nov 15 01:08:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=80.90.142.216, lip=66.85.158.91, TLS, session=<H96VIpNDowhQWo7Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.70
country_id: 3175395
description:
Nov 15 01:08:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=217.26.179.70, lip=66.85.158.91, TLS, session=<Zb3FI5ND/+bZGrNG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.58
country_id: 6251999
description:
2025-11-15 01:19:48 dovecot_login authenticator failed for (ADMIN) [66.56.80.58]:33090: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 01:21:06 host2 sshd[4184473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.86
country_id: 6252001
description:
Nov 15 01:23:51 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.86, lip=66.85.158.92, session=<0OBPW5NDZJ6s7ORW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Nov 15 01:24:19 host2 sshd[4186193]: Disconnected from invalid user wwww 42.200.78.78 port 33568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Nov 15 01:26:01 host2 sshd[4187122]: Disconnected from invalid user ftpuser 42.200.78.78 port 40578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Nov 15 01:27:22 host2 sshd[4187851]: Disconnected from invalid user jeus 42.200.78.78 port 43490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Nov 15 01:30:01 host2 sshd[4189133]: Disconnected from invalid user steam 42.200.78.78 port 49320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-11-15 01:36:19 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:64163: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-11-15 01:36:33 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:48922: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-15 01:38:08 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (garamods) [98.227.25.115]:45350: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.112.209
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 163.5.112.209 - cloudt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.36
country_id: 3175395
description:
Nov 15 01:44:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=195.177.113.36, lip=66.85.158.91, TLS, session=<oKewpZNDGIrDsXEk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.108.125
country_id: 3865483
description:
Nov 15 01:45:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=190.181.108.125, lip=66.85.158.91, TLS, session=<BIfippNDJJG+tWx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.158
country_id: 6252001
description:
2025-11-15 01:45:47 dovecot_login authenticator failed for (ADMIN) [79.127.132.158]:53226: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.217.108
country_id: 2921044
description:
Nov 15 01:49:42 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.217.108, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<qde+t5NDvYnRJtls>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.184.19
country_id: 2921044
description:
Nov 15 01:50:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.90.184.19, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SlrYuZNDwBikWrgT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-11-15 01:54:18 dovecot_login authenticator failed for ([206.217.141.77]) [206.217.141.77]:60050: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.15.69
country_id: 3469034
description:
2025-11-15 01:54:33 dovecot_login authenticator failed for ([177.174.15.89]) [177.174.15.69]:50511: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 15 01:58:13 host2 sshd[12662]: Disconnected from invalid user chromeuser 143.110.186.36 port 54128 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 15 02:02:15 host2 sshd[15710]: Disconnected from invalid user sri 143.110.186.36 port 43070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.150
country_id: 2328926
description:
2025-11-15 02:03:38 dovecot_login authenticator failed for (ADMIN) [146.70.65.150]:56444: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.59
country_id: 953987
description:
Nov 15 02:05:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.32.59, lip=66.85.158.91, TLS, session=<P5uC8JNDmsZmQCA7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.101.145
country_id: 798544
description:
Nov 15 02:06:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=178.219.101.145, lip=66.85.158.91, TLS, session=<xavQ8ZNDteWy22WR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 15 02:08:11 host2 sshd[19371]: Disconnected from invalid user etienne 139.59.66.39 port 56992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 15 02:07:30 host2 sshd[19089]: Disconnected from invalid user ubuntu 143.110.186.36 port 46434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 15 02:10:46 host2 sshd[21094]: Disconnected from invalid user trans 139.59.66.39 port 40576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 02:12:18 host2 sshd[21773]: Disconnected from invalid user user 2.57.121.25 port 48859 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 15 02:13:21 host2 sshd[22785]: Disconnected from invalid user sri 139.59.66.39 port 58014 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.19.44
country_id: 2921044
description:
Nov 15 02:13:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=159.223.19.44, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QyekDZRDaHef3xMs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 15 02:21:06 host2 sshd[27349]: Disconnected from invalid user desliga 103.231.14.54 port 36248 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 15 02:22:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<t3ahK5RDWlQv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.92.22
country_id: 6252001
description:
Nov 15 02:21:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.92.22, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<sgXWKZRDdrkv+1wW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 15 02:22:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<IKUeLJRD7OMv+zWT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 15 02:23:50 host2 sshd[28686]: Disconnected from invalid user frappe 103.231.14.54 port 51462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-15 02:24:59 dovecot_plain authenticator failed for (brivauty) [62.74.225.186]:34273: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-15 02:25:59 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:53208: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-11-15 02:26:28 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:35081: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.62
country_id: 1668284
description:
2025-11-15 02:28:12 dovecot_login authenticator failed for (ADMIN) [173.244.49.62]:52616: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.112.209
country_id: 3017382
description:
[2025-11-15 02:27:44 +0530] info [whostmgrd] 163.5.112.209 - cloudt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 15 02:29:16 host2 sshd[31962]: Disconnected from invalid user me 103.231.14.54 port 49034 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.188.199
country_id: 6252001
description:
Nov 15 02:32:04 host2 pure-ftpd[33534]: (?@44.220.188.199) [INFO] New connection from 44.220.188.199


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 02:34:47 host2 sshd[34769]: Disconnected from invalid user  2.57.121.112 port 61316 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 02:36:30 host2 sshd[35919]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.43.156
country_id: 732800
description:
2025-11-15 02:36:26 dovecot_login authenticator failed for 77-85-43-156.ip.btc-net.bg [77.85.43.156]:39066: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.226
country_id: 3017382
description:
2025-11-15 02:36:52 dovecot_login authenticator failed for ([46.254.229.4]) [185.137.75.226]:51384: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 02:41:08 host2 sshd[38464]: Disconnected from invalid user moth3r 2.57.121.112 port 62635 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-11-15 02:40:55 dovecot_plain authenticator failed for (sulamelize) [24.93.140.162]:47463: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.27.3
country_id: 933860
description:
Nov 15 02:42:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=83.143.27.3, lip=66.85.158.91, TLS, session=<MuFSc5RDoNxTjxsD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.30
country_id: 732800
description:
Nov 15 02:42:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=185.255.212.30, lip=66.85.158.91, TLS, session=<AU6CdJRDTca5/9Qe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.28
country_id: 6290252
description:
2025-11-15 02:45:38 dovecot_login authenticator failed for (ADMIN) [37.46.115.28]:44982: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.161.174.170
country_id: 6251999
description:
Nov 15 02:46:48 host2 pure-ftpd[42306]: (?@51.161.174.170) [INFO] New connection from 51.161.174.170


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 51.161.174.170
country_id: 6251999
description:
Nov 15 02:46:56 host2 pure-ftpd[42354]: (?@51.161.174.170) [INFO] New connection from 51.161.174.170


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 02:48:28 host2 sshd[43270]: Disconnected from invalid user admin 2.57.121.112 port 37823 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 02:54:28 host2 sshd[47230]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.124.75
country_id: 2921044
description:
Nov 15 03:00:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=159.65.124.75, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0HowtJRDJC2fQXxL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.86
country_id: 3175395
description:
Nov 15 03:03:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=171.22.234.86, lip=66.85.158.91, TLS, session=<PVr8vpRDW+mrFupW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.209
country_id: 3469034
description:
Nov 15 03:03:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.89.136.209, lip=66.85.158.91, TLS, session=<enG5vZRDpZy+WYjR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.116
country_id: 1880251
description:
2025-11-15 03:04:49 dovecot_login authenticator failed for (ADMIN) [156.146.57.116]:8481: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 03:11:05 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64514: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.210.195
country_id: 2077456
description:
2025-11-15 03:21:21 dovecot_login authenticator failed for (ADMIN) [191.101.210.195]:3581: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 15 03:21:29 host2 sshd[65581]: Disconnected from invalid user pilot 85.209.134.43 port 44136 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.57
country_id: 6252001
description:
Nov 15 03:21:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.57, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZvnWAJVDX8zG6xg5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 03:22:13 host2 sshd[66084]: Disconnected from invalid user admin 2.57.121.112 port 53473 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.15
country_id: 2635167
description:
Nov 15 03:22:15 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.15, lip=66.85.158.92, TLS, session=<bAnFApVD1ZdX7LAP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.21
country_id: 2635167
description:
Nov 15 03:22:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.21, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Y83WApVDSdBX7LAV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.33
country_id: 2635167
description:
Nov 15 03:23:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.33, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<H/vQCJVDK+lX7LAh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-15 03:24:01 dovecot_plain authenticator failed for (unhind) [12.150.243.22]:25743: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-15 03:24:01 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:45246: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-11-15 03:24:07 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:57252: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.13
country_id: 2635167
description:
Nov 15 03:23:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.13, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<AqXVBpVDX6NX7LAN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.30
country_id: 2635167
description:
Nov 15 03:24:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.30, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<4I3MCpVDJZ+594ke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.2
country_id: 6252001
description:
2025-11-15 03:25:01 dovecot_plain authenticator failed for ([10.4.2.55]) [209.160.115.2]:49497: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.28
country_id: 2635167
description:
Nov 15 03:25:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.28, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hSXGDJVDI+lX7LAc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.2
country_id: 6252001
description:
2025-11-15 03:25:22 dovecot_plain authenticator failed for ([10.4.2.55]) [209.160.115.2]:55620: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.25
country_id: 2635167
description:
Nov 15 03:25:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.25, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<0mbDDpVDx9u594kZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.20
country_id: 2635167
description:
Nov 15 03:26:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.20, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Cee+EJVDkaO594kU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.5
country_id: 2635167
description:
Nov 15 03:26:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.5, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<6zu4EpVDTddX7LAF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.34
country_id: 2635167
description:
Nov 15 03:27:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=</YSzFJVD6eFX7LAi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.8.19.90
country_id: 6252001
description:
2025-11-15 03:31:03 dovecot_plain authenticator failed for ([172.23.0.4]) [45.8.19.90]:55464: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 03:30:39 host2 sshd[71633]: Disconnected from invalid user user 2.57.121.25 port 16727 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.62
country_id: 953987
description:
Nov 15 03:31:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=102.129.61.62, lip=66.85.158.91, TLS, session=<jxs4IpVDQplmgT0+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.140
country_id: 298795
description:
Nov 15 03:31:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=149.34.211.140, lip=66.85.158.91, TLS, session=<co1zI5VDB76VItOM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 15 03:32:16 host2 sshd[72668]: Disconnected from invalid user intel 85.209.134.43 port 53678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 15 03:35:33 host2 sshd[74741]: Disconnected from invalid user sia 85.209.134.43 port 39072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 15 03:36:41 host2 sshd[75470]: Disconnected from invalid user frappe 85.209.134.43 port 34510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.100
country_id: 2635167
description:
2025-11-15 03:38:39 dovecot_login authenticator failed for (ADMIN) [98.159.234.100]:13621: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.210
country_id: 3469034
description:
Nov 15 03:39:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.130.171.210, lip=66.85.158.91, TLS, session=<yqv1P5VD1oOxgqvS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:39:44 host2 sshd[77365]: Disconnected from invalid user omega 103.86.180.10 port 49465 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.97.204.27
country_id: 798544
description:
Nov 15 03:39:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=217.97.204.27, lip=66.85.158.91, TLS, session=<ZTcZQZVDUoTZYcwb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.125
country_id: 6252001
description:
Nov 15 03:39:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.125, lip=66.85.158.91, TLS: Connection closed, session=<eFL3P5VDarvHLZp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:41:14 host2 sshd[78279]: Disconnected from invalid user asuarez 103.86.180.10 port 36743 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:45:03 host2 sshd[80254]: Disconnected from invalid user test1 103.86.180.10 port 51907 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:47:06 host2 sshd[82678]: Disconnected from invalid user admin 103.86.180.10 port 38170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 15 03:49:44 host2 sshd[84965]: Disconnected from invalid user xrdp 103.86.180.10 port 38874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 15 03:50:54 host2 sshd[85946]: Disconnected from invalid user test 37.255.249.201 port 53386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.255.249.201
country_id: 130758
description:
Nov 15 03:52:12 host2 sshd[86879]: Disconnected from invalid user omega 37.255.249.201 port 56396 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.109
country_id: 6252001
description:
Nov 15 03:52:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c/fLb5VDtsGTuYRt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 15 03:54:51 host2 sshd[89528]: Disconnected from invalid user xrdp 37.255.249.201 port 52518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Nov 15 03:56:18 host2 sshd[90771]: Disconnected from invalid user hehongju 35.240.75.51 port 60400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Nov 15 03:57:45 host2 sshd[92070]: Disconnected from invalid user user 35.240.75.51 port 53844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 15 03:57:27 host2 sshd[91788]: Disconnected from invalid user devops 37.255.249.201 port 60862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.61
country_id: 2186224
description:
2025-11-15 04:00:00 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:60340: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-15 03:59:23 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:45544: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.121
country_id: 3469034
description:
Nov 15 04:00:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.120.73.121, lip=66.85.158.91, TLS, session=<WxICipVDHOe7eEl5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.173.196.229
country_id: 130758
description:
Nov 15 04:00:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=178.173.196.229, lip=66.85.158.91, TLS, session=<l1I/i5VDxoSyrcTl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:02:10 host2 sshd[96102]: Disconnected from invalid user gm 89.126.209.230 port 41274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:03:38 host2 sshd[98037]: Disconnected from invalid user vlad 89.126.209.230 port 43028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.203.16
country_id: 2077456
description:
2025-11-15 04:04:28 dovecot_login authenticator failed for (ADMIN) [173.239.203.16]:63023: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 04:06:27 host2 sshd[101066]: Disconnected from invalid user admin 2.57.121.112 port 52703 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.208
country_id: 6252001
description:
Nov 15 04:06:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.208, lip=66.85.158.91, TLS, session=<VvFloJVDduPG6xjQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:08:32 host2 sshd[103603]: Disconnected from invalid user admin 89.126.209.230 port 42176 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 04:09:49 host2 sshd[104975]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Nov 15 04:09:22 host2 sshd[104588]: Disconnected from invalid user teamspeak3 45.78.197.91 port 57692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Nov 15 04:09:38 host2 sshd[104770]: Disconnected from invalid user randy 35.240.75.51 port 42674 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.79.238
country_id: 2921044
description:
Nov 15 04:09:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=64.226.79.238, lip=66.85.158.92, session=<zI92rJVDC8ZA4k/u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.184.19
country_id: 2921044
description:
Nov 15 04:09:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.90.184.19, lip=66.85.158.92, session=</AOErJVDtoakWrgT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:13:26 host2 sshd[109336]: Disconnected from invalid user dummy 193.122.200.89 port 54308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:13:19 host2 sshd[109234]: Disconnected from invalid user odoo13 89.126.209.230 port 41294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.209.230
country_id: 1512440
description:
Nov 15 04:18:20 host2 sshd[114447]: Disconnected from invalid user nominatim 89.126.209.230 port 40448 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.39
country_id: 6252001
description:
Nov 15 04:21:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5TuK1pVDB8rG6xgn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.69.253
country_id: 6252001
description:
Nov 15 04:22:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.69.253, lip=66.85.158.92, session=<omz72JVDxpQtIUX9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:22:08 host2 sshd[119765]: Disconnected from invalid user mike 193.122.200.89 port 52914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Nov 15 04:25:05 host2 sshd[121203]: Disconnected from invalid user user 45.78.197.91 port 48564 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Nov 15 04:25:54 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<V2Bh5pVD+I1HBobn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-11-15 04:26:18 dovecot_plain authenticator failed for (andortomy) [88.149.153.106]:46756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 04:27:46 host2 sshd[123161]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:29:51 host2 sshd[124339]: Disconnected from invalid user kata 193.122.200.89 port 36350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.177
country_id: 3144096
description:
2025-11-15 04:32:23 dovecot_login authenticator failed for (ADMIN) [46.246.122.177]:33542: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:33:47 host2 sshd[126411]: Disconnected from invalid user teamspeak3 193.122.200.89 port 55356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Nov 15 04:34:56 host2 sshd[127006]: Disconnected from invalid user armin 45.78.197.91 port 43992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.226.144
country_id: 2921044
description:
Nov 15 04:37:44 host2 sshd[128636]: Disconnected from invalid user test 91.108.226.144 port 38294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 04:40:03 host2 sshd[129795]: Disconnected from invalid user admin 2.57.121.112 port 9577 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-15 04:41:40 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:33946: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-15 04:42:06 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:37310: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.108.226.144
country_id: 2921044
description:
Nov 15 04:42:59 host2 sshd[131331]: Disconnected from invalid user user 91.108.226.144 port 59642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Nov 15 04:44:36 host2 sshd[132149]: Disconnected from invalid user data 45.78.197.91 port 46622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.247.119
country_id: 1819730
description:
Nov 15 04:45:20 host2 sshd[133202]: Disconnected from invalid user user2 34.92.247.119 port 57794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 15 04:46:07 host2 sshd[133742]: Disconnected from invalid user client 154.16.81.78 port 56152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.247.119
country_id: 1819730
description:
Nov 15 04:46:47 host2 sshd[134225]: Disconnected from invalid user adriano 34.92.247.119 port 59788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 15 04:47:28 host2 sshd[134558]: Disconnected from invalid user adriano 154.16.81.78 port 33160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 15 04:48:46 host2 sshd[135069]: Disconnected from invalid user user123 154.16.81.78 port 36078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.122.200.89
country_id: 6252001
description:
Nov 15 04:49:30 host2 sshd[135411]: Disconnected from invalid user data 193.122.200.89 port 38186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 04:49:47 host2 sshd[135537]: Disconnected from invalid user test 154.91.170.39 port 42240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-15 04:49:14 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (unspelled) [68.82.141.145]:53752: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 04:51:00 host2 sshd[136333]: Disconnected from invalid user node 64.23.180.137 port 60222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.226.144
country_id: 2921044
description:
Nov 15 04:51:21 host2 sshd[136545]: Disconnected from invalid user user 91.108.226.144 port 45940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 04:52:47 host2 sshd[137172]: Disconnected from invalid user teste1 64.23.180.137 port 54304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.64
country_id: 1814991
description:
2025-11-15 04:52:57 dovecot_login authenticator failed for (ADMIN) [188.241.80.64]:35442: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.177
country_id: 1643084
description:
Nov 15 04:54:40 host2 sshd[138917]: Disconnected from invalid user ubuntu 27.112.78.177 port 47118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 04:55:04 host2 sshd[139181]: Disconnected from invalid user degen 64.23.180.137 port 40898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 04:54:26 host2 sshd[138765]: Disconnected from invalid user user2 154.91.170.39 port 42616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 04:56:25 host2 sshd[139932]: Disconnected from invalid user user 2.57.121.25 port 34588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 04:56:29 host2 sshd[139997]: Disconnected from invalid user degen 154.91.170.39 port 42812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.177
country_id: 1643084
description:
Nov 15 04:56:33 host2 sshd[140012]: Disconnected from invalid user lruiz 27.112.78.177 port 45010 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 15 04:56:45 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<rWu4VJZDwq9HBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 15 04:56:48 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<zQjnVJZD5L1HBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 04:58:42 host2 sshd[141109]: Disconnected from invalid user deepak 154.91.170.39 port 43018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 04:59:23 host2 sshd[141581]: Disconnected from invalid user adminz 64.23.180.137 port 43934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.177
country_id: 1643084
description:
Nov 15 05:00:10 host2 sshd[142168]: Disconnected from invalid user ubuntu 27.112.78.177 port 52012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 15 05:00:27 host2 sshd[142365]: Disconnected from invalid user test 64.23.180.137 port 50508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.39
country_id: 241170
description:
Nov 15 05:01:48 host2 sshd[143354]: Disconnected from invalid user orange 154.91.170.39 port 43340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-15 05:10:52 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (unrous) [217.215.74.195]:48368: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.177
country_id: 1643084
description:
Nov 15 05:12:52 host2 sshd[150217]: Disconnected from invalid user dan 27.112.78.177 port 42446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.18
country_id: 289688
description:
2025-11-15 05:14:43 dovecot_login authenticator failed for (ADMIN) [95.181.234.18]:51124: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 15 05:18:12 host2 sshd[154028]: Disconnected from invalid user mostafa 103.182.132.154 port 44446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.158
country_id: 690791
description:
Nov 15 05:18:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=176.103.2.158, lip=66.85.158.91, TLS, session=<YqGqopZD1qmwZwKe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.154
country_id: 953987
description:
Nov 15 05:19:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.52.154, lip=66.85.158.91, TLS, session=<pZfLo5ZDq7JmgTSa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-11-15 05:20:45 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:43590: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-15 05:21:11 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:51004: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Nov 15 05:21:14 host2 sshd[156240]: Disconnected from invalid user administrator 212.19.117.204 port 44172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.233.191
country_id: 6252001
description:
Nov 15 05:21:53 host2 sshd[156475]: Disconnected from invalid user odoo 192.3.233.191 port 50658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.233.191
country_id: 6252001
description:
Nov 15 05:23:08 host2 sshd[157310]: Disconnected from invalid user paul 192.3.233.191 port 52896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.124.182.133
country_id: 3175395
description:
Nov 15 05:24:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=185.124.182.133, lip=66.85.158.91, TLS, session=<DNZQuZZDzqO5fLaF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.190.142
country_id: 3175395
description:
Nov 15 05:24:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.208.190.142, lip=66.85.158.91, TLS, session=<4BuntZZDNIS50L6O>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 15 05:24:11 host2 sshd[157973]: Disconnected from invalid user admin 103.182.132.154 port 58170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Nov 15 05:24:33 host2 sshd[158183]: Disconnected from invalid user login 212.19.117.204 port 57969 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.226.154.124
country_id: 3469034
description:
Nov 15 05:24:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<587hr>, method=PLAIN, rip=45.226.154.124, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NU/GtpZDzg8t4pp8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 15 05:25:45 host2 sshd[158995]: Disconnected from invalid user syncuser 103.182.132.154 port 57526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-11-15 05:26:47 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (smive) [174.169.224.27]:42634: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-11-15 05:26:51 dovecot_plain authenticator failed for (beschanest) [199.192.123.12]:47550: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.169.255
country_id: 3469034
description:
Nov 15 05:27:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.130.169.255, lip=66.85.158.91, TLS, session=<95MiwpZDD7qxgqn/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.94
country_id: 3469034
description:
Nov 15 05:28:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=177.44.71.94, lip=66.85.158.91, TLS, session=<4/1ow5ZDOKyxLEde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-15 05:29:22 dovecot_plain authenticator failed for (laterees) [154.144.255.209]:57958: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 15 05:36:56 host2 sshd[165781]: Disconnected from invalid user test 103.182.132.154 port 50590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.82
country_id: 2782113
description:
2025-11-15 05:42:46 dovecot_login authenticator failed for (ADMIN) [156.146.60.82]:8792: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 05:43:08 host2 sshd[169137]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-11-15 05:43:44 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:54802: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-15 05:43:59 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:60774: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.213
country_id: 933860
description:
Nov 15 05:44:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=41.216.215.213, lip=66.85.158.91, TLS, session=<Gh1G/pZD85Ip2NfV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.222
country_id: 953987
description:
Nov 15 05:44:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.51.222, lip=66.85.158.91, TLS, session=<LQyR/5ZDvNlmgTPe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:49:16 host2 sshd[173048]: Disconnected from invalid user ramon 195.178.191.5 port 34544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 05:52:24 host2 sshd[174784]: Disconnected from invalid user ramon 50.84.211.204 port 55328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:52:49 host2 sshd[174927]: Disconnected from invalid user test2 195.178.191.5 port 33950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 05:53:32 host2 sshd[175373]: Disconnected from invalid user carol 50.84.211.204 port 54882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 15 05:53:47 host2 sshd[175443]: Disconnected from invalid user koha 134.209.225.104 port 50888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 05:54:40 host2 sshd[176274]: Disconnected from invalid user koha 50.84.211.204 port 54438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:55:11 host2 sshd[176855]: Disconnected from invalid user deploy 195.178.191.5 port 45864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 05:55:49 host2 sshd[177162]: Disconnected from invalid user sduran 50.84.211.204 port 53994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 15 05:55:56 host2 sshd[177191]: Disconnected from invalid user carol 134.209.225.104 port 50512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:56:32 host2 sshd[177621]: Disconnected from invalid user deploy 195.178.191.5 port 44150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.237.115.242
country_id: 1880251
description:
Nov 15 05:56:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.237.115.242, lip=66.85.158.92, session=<B0r8K5dDii4v7XPy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.178.191.5
country_id: 2661886
description:
Nov 15 05:59:13 host2 sshd[179061]: Disconnected from invalid user wei 195.178.191.5 port 58418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.91
country_id: 3017382
description:
2025-11-15 05:59:34 dovecot_login authenticator failed for (ADMIN) [203.188.183.91]:54158: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 15 06:00:14 host2 sshd[179750]: Disconnected from invalid user lili 134.209.225.104 port 38368 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 06:01:07 host2 sshd[180382]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 15 06:01:27 host2 sshd[180558]: Disconnected from invalid user admin 50.84.211.204 port 51762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 06:08:10 host2 sshd[184356]: Disconnected from invalid user fredrick 62.60.131.157 port 64711 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-15 06:08:57 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:56832: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-11-15 06:09:31 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:50857: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 06:11:52 host2 sshd[186648]: Disconnected from invalid user admin 2.57.121.112 port 61371 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.168
country_id: 6252001
description:
Nov 15 06:14:47 host2 pure-ftpd[189091]: (?@198.235.24.168) [INFO] New connection from 198.235.24.168


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 06:18:08 host2 sshd[191080]: Disconnected from invalid user admin 2.57.121.112 port 62706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.196
country_id: 298795
description:
Nov 15 06:20:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=95.0.32.196, lip=66.85.158.91, TLS, session=<sSHmfpdDpJxfACDE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.77
country_id: 3175395
description:
Nov 15 06:20:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.124.182.77, lip=66.85.158.91, TLS, session=<4Ob0f5dDgLa5fLZN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.217.112.99
country_id: 798544
description:
Nov 15 06:22:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.217.112.99, lip=66.85.158.91, TLS, session=<fyLzhJdDkZ2y2XBj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.171
country_id: 953987
description:
Nov 15 06:22:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.64.32.171, lip=66.85.158.91, TLS, session=<GS0ThpdD0MhmQCCr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.184
country_id: 1694008
description:
2025-11-15 06:25:24 dovecot_login authenticator failed for (ADMIN) [188.214.125.184]:9573: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.167
country_id: 6252001
description:
Nov 15 06:29:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.167, lip=66.85.158.92, TLS, session=<tOb3oJdD7vjN0h+n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-15 06:37:40 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:52219: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-15 06:38:49 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:57676: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-15 06:39:05 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:46708: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.35
country_id: 1733045
description:
2025-11-15 06:38:28 dovecot_login authenticator failed for ([49.124.153.35]) [49.124.153.35]:59678: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-15 06:39:34 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:35097: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 06:41:04 host2 sshd[203954]: Disconnected from invalid user admin 2.57.121.112 port 9484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-11-15 06:54:31 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:53952: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-11-15 06:54:40 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:56274: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 06:55:26 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49706: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.11
country_id: 953987
description:
Nov 15 06:59:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.53.11, lip=66.85.158.91, TLS, session=<c1rUCJhDWsRmgTUL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.187
country_id: 953987
description:
Nov 15 06:58:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.45.187, lip=66.85.158.91, TLS, session=<WTCIB5hDo+hmQC27>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.227
country_id: 6252001
description:
Nov 15 07:00:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.227, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lKeZEJhDGMXN0h/j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.190.159
country_id: 3175395
description:
Nov 15 07:01:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.208.190.159, lip=66.85.158.91, TLS, session=<SlnoEphD9Mu50L6f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.120.206
country_id: 3469034
description:
Nov 15 07:02:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=186.224.120.206, lip=66.85.158.91, TLS, session=<GK8sFJhDwdS64HjO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.122
country_id: 3865483
description:
Nov 15 07:08:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.11.195.122, lip=66.85.158.91, TLS, session=<fRh2LJhDsqS+C8N6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.189.34
country_id: 3469034
description:
Nov 15 07:09:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=45.179.189.34, lip=66.85.158.91, TLS, session=<BfOyLZhDGMQts70i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 07:14:10 host2 sshd[224501]: Disconnected from invalid user admin 2.57.121.112 port 23691 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.139.234
country_id: 2921044
description:
2025-11-15 07:15:16 dovecot_login authenticator failed for ([144.31.139.234]) [144.31.139.234]:60018: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-11-15 07:15:39 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:60652: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 07:16:34 host2 sshd[225768]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 15 07:21:06 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, TLS: Connection closed, session=<+5n0WJhDhJwz3piW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 15 07:21:11 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<mjA8WZhDlpwz3piW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 07:29:54 host2 sshd[233796]: Disconnected from invalid user user 2.57.121.25 port 11220 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 07:34:34 host2 sshd[236994]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 07:36:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, session=<lMF+kJhDyoG4aYtF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.153
country_id: 6252001
description:
Nov 15 07:36:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.153, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8ECakZhD+f5APsWZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Nov 15 07:37:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<UaGpkphD6K1APsWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.4
country_id: 6252001
description:
Nov 15 07:42:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, session=<HAUNpphDiKfLN4ME>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Nov 15 07:42:53 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.92, TLS, session=<f4/UpphDeuNHBobp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.84
country_id: 6252001
description:
Nov 15 07:49:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.84, lip=66.85.158.91, TLS: Connection closed, session=<L2H3vZhDqNPHLZtU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.28.138
country_id: 1269750
description:
2025-11-15 07:54:45 dovecot_login authenticator failed for ([125.22.221.129]) [125.17.28.138]:53596: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-11-15 07:55:10 dovecot_login authenticator failed for ([103.245.109.37]) [103.245.109.37]:44664: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 07:57:31 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<kOoz25hDGrEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 07:59:11 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Rp0j4ZhDGu4DhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 07:59:34 host2 sshd[252323]: Disconnected from invalid user  2.57.121.112 port 62702 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:00:46 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<bgzN5phDLosDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:01:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<UwMs65hD/M8DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:01:59 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<y5sf65hD+M8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:02:24 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Ba6g7JhDJMcDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:03:35 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<a3Ll8JhDrL0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:03:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<oEwM8ZhDOOoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:04:09 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<X0Ht8phDEqkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 15 08:05:44 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<H86N+JhDqL4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.137
country_id: 6252001
description:
Nov 15 08:05:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.137, lip=66.85.158.91, session=<E4dv+ZhDF8DDuEyJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.137
country_id: 6252001
description:
Nov 15 08:06:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.137, lip=66.85.158.91, session=</pEL+phDNcfDuEyJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.139
country_id: 6252001
description:
Nov 15 08:06:17 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.139, lip=66.85.158.91, session=<+POA+phDpZ3DuEyL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.211
country_id: 6252001
description:
Nov 15 08:06:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.211, lip=66.85.158.91, session=<AwWx+phDk57DuEzT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:10:24 host2 sshd[259289]: Disconnected from invalid user ubuntu 103.217.144.65 port 42106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 15 08:11:38 host2 sshd[260142]: Disconnected from invalid user user1 41.111.162.34 port 10020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.8.51
country_id: 2300660
description:
Nov 15 08:12:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.139.8.51, lip=66.85.158.91, TLS, session=</hysEJlDiugpiwgz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.223
country_id: 953987
description:
Nov 15 08:13:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=102.64.39.223, lip=66.85.158.91, TLS, session=<254JEplDyaxmQCff>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.96
country_id: 3624060
description:
2025-11-15 08:14:07 dovecot_login authenticator failed for ([186.177.88.96]) [186.177.88.96]:47975: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:14:22 host2 sshd[261838]: Disconnected from invalid user bitrix 103.217.144.65 port 43960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-11-15 08:14:33 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:51889: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 119.28.107.251 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:16:19 host2 sshd[263094]: Disconnected from invalid user tabata 103.217.144.65 port 54296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 15 08:16:29 host2 sshd[263293]: Disconnected from invalid user parth 41.111.162.34 port 6639 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:19:59 host2 sshd[265350]: Disconnected from invalid user test 103.217.144.65 port 34652 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.88
country_id: 6252001
description:
Nov 15 08:21:32 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.155.88, lip=66.85.158.92, TLS: Connection closed, session=<D/MOMZlDQpzHLZtY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Nov 15 08:21:57 host2 sshd[266948]: Disconnected from invalid user mac 103.217.144.65 port 36862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 08:26:13 host2 sshd[269537]: Disconnected from invalid user kurtis 62.60.131.157 port 51482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 15 08:27:41 host2 sshd[270730]: Disconnected from invalid user vlad 177.85.247.230 port 44058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 08:28:29 host2 sshd[271216]: Disconnected from invalid user user 2.57.121.25 port 10072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 15 08:29:11 host2 sshd[271592]: Disconnected from invalid user odoo13 177.85.247.230 port 22974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.32.230.230
country_id: 2635167
description:
2025-11-15 08:31:17 dovecot_plain authenticator failed for uddi-29-b2-v4wan-166599-cust1765.vm12.cable.virginm.net (garamods) [82.32.230.230]:54986: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 15 08:31:53 host2 sshd[273300]: Disconnected from invalid user mahesh 177.85.247.230 port 65222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.152.231
country_id: 690791
description:
Nov 15 08:33:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.221.152.231, lip=66.85.158.91, TLS, session=<gOL7WZlDM6kl3Zjn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.25.132.45
country_id: 1269750
description:
Nov 15 08:33:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=103.25.132.45, lip=66.85.158.91, TLS, session=<bKEaW5lDh+xnGYQt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Nov 15 08:41:46 host2 sshd[280232]: Disconnected from invalid user gm 181.0.192.28 port 1229 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 15 08:43:57 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<X0xCgZlD2MxHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 15 08:43:58 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<0EFKgZlDsM5HBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Nov 15 08:48:23 host2 sshd[286534]: Disconnected from invalid user mahesh 181.0.192.28 port 14066 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.0.192.28
country_id: 3865483
description:
Nov 15 08:50:05 host2 sshd[287639]: Disconnected from invalid user admin 181.0.192.28 port 1979 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 08:50:09 host2 sshd[287700]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 08:54:13 host2 sshd[289069]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Nov 15 08:56:46 host2 sshd[292733]: Disconnected from invalid user kizzy 181.0.192.28 port 7993 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 15 08:59:59 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<bSKMuplDNsWTuYVQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 15 09:00:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zuJ9u5lDQPyTuYVQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-15 09:04:14 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:59388: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-11-15 09:04:32 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:55908: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.49.245.100
country_id: 3469034
description:
Nov 15 09:04:55 host2 sshd[298567]: Disconnected from invalid user hari 201.49.245.100 port 62209 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 15 09:06:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS, session=</fRK0plDWu+TuYVQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 09:08:14 host2 sshd[300661]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.122
country_id: 226074
description:
Nov 15 09:09:25 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=196.0.122.122, lip=66.85.158.91, TLS, session=<OEwC25lDP7jEAHp6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.143.206
country_id: 690791
description:
Nov 15 09:09:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=37.221.143.206, lip=66.85.158.91, TLS, session=<0dVX3JlD7uol3Y/O>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.49.245.100
country_id: 3469034
description:
Nov 15 09:14:00 host2 sshd[305104]: Disconnected from invalid user manager 201.49.245.100 port 63330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 09:14:37 host2 sshd[305676]: Disconnected from invalid user admin 2.57.121.112 port 31585 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-15 09:15:59 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (ureet) [217.215.74.195]:56630: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.49.245.100
country_id: 3469034
description:
Nov 15 09:15:28 host2 sshd[306422]: Disconnected from invalid user feedback 201.49.245.100 port 61843 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.49.245.100
country_id: 3469034
description:
Nov 15 09:18:26 host2 sshd[308521]: Disconnected from invalid user pacific 201.49.245.100 port 62359 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.137.142.246
country_id: 1655842
description:
2025-11-15 09:29:29 dovecot_login authenticator failed for ([202.137.142.246]) [202.137.142.246]:59538: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-15 09:29:35 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:49885: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.222
country_id: 690791
description:
Nov 15 09:29:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.221.147.222, lip=66.85.158.91, TLS, session=<NVg2JJpDv8sl3ZPe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.190.96.234
country_id: 3469034
description:
Nov 15 09:30:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=179.190.96.234, lip=66.85.158.91, TLS, session=<eSxZJZpDBYOzvmDq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.171
country_id: 6252001
description:
Nov 15 09:33:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.171, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<BOpnMppDy9LN0h+r>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-15 09:44:11 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:41312: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 15 09:46:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, TLS: Connection closed, session=<V0ylYJpD4MSUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 09:46:41 host2 sshd[328816]: Disconnected from invalid user  2.57.121.112 port 62524 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.193.226.186
country_id: 6252001
description:
[2025-11-15 09:47:30 +0530] info [whostmgrd] 73.193.226.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 09:47:36 host2 sshd[329344]: Disconnected from invalid user admin 2.57.121.112 port 43681 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 15 09:49:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.91, session=<Z8MGappDINmUcdUX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 09:52:53 host2 sshd[332675]: Disconnected from invalid user  2.57.121.112 port 61580 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 09:53:46 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<497neppDVswjy9Pk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 09:54:36 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<t5jefZpDqOYjy9Pk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 09:55:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<8iNtgJpD7P0jy9Pk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Nov 15 09:55:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS: Connection closed, session=<454LgZpDJNynXpIy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 10:00:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS, session=<LwTskppDavIjy9Pk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.228
country_id: 2635167
description:
Nov 15 10:01:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.228, lip=66.85.158.91, TLS, session=<uhiLlZpDmPEjy9Pk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 15 10:05:20 host2 sshd[341859]: Disconnected from invalid user mamad 185.216.119.134 port 48582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 15 10:06:51 host2 sshd[342675]: Disconnected from invalid user user 185.216.119.134 port 51776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 15 10:08:16 host2 sshd[343500]: Disconnected from invalid user user 185.216.119.134 port 54960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 15 10:12:44 host2 sshd[346509]: Disconnected from invalid user wedding 185.216.119.134 port 36286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-11-15 10:17:23 dovecot_login authenticator failed for 5.185.198.73.ipv4.public.orange.pl [5.185.198.73]:45860: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-15 10:17:16 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:51865: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.135.238
country_id: 99237
description:
Nov 15 10:18:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=65.20.135.238, lip=66.85.158.91, TLS, session=<uRJI0ppDBe1BFIfu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.2.189.96
country_id: 798544
description:
Nov 15 10:18:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=83.2.189.96, lip=66.85.158.91, TLS, session=<QhIt0ZpDtKJTAr1g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.159.7
country_id: 2921044
description:
Nov 15 10:19:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.159.7, lip=66.85.158.92, TLS, session=<K4rZ15pDctOl458H>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.210.106
country_id: 1819730
description:
Nov 15 10:23:10 host2 pure-ftpd[353746]: (?@123.58.210.106) [INFO] New connection from 123.58.210.106


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.210.106
country_id: 1819730
description:
Nov 15 10:25:00 host2 pure-ftpd[354990]: (?@123.58.210.106) [INFO] New connection from 123.58.210.106


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.210.106
country_id: 1819730
description:
Nov 15 10:25:19 host2 pure-ftpd[355410]: (?@123.58.210.106) [INFO] New connection from 123.58.210.106


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 10:31:01 host2 sshd[358995]: Disconnected from invalid user admin 2.57.121.112 port 52439 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 180.75.48.12
country_id: 1733045
description:
Nov 15 10:34:19 host2 sshd[360989]: Disconnecting authenticating user root 180.75.48.12 port 48339: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 180.75.48.12
country_id: 1733045
description:
Nov 15 10:34:19 host2 sshd[360989]: error: maximum authentication attempts exceeded for root from 180.75.48.12 port 48339 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.75.48.12
country_id: 1733045
description:
Nov 15 10:34:41 host2 sshd[361176]: Disconnecting invalid user admin 180.75.48.12 port 49160: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.47.88
country_id: 6252001
description:
2025-11-15 10:38:13 dovecot_plain authenticator failed for ([10.143.41.218]) [143.244.47.88]:56904: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 10:41:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58821: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.87
country_id: 6252001
description:
Nov 15 10:46:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.87, lip=66.85.158.92, session=<UYh6NptDmPuTuYRX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov 15 10:50:54 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.91, session=<cZ84R5tDioCUcd0c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.232
country_id: 6252001
description:
Nov 15 10:53:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.232, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<N9G5UZtDj8DG6xjo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.186.239.214
country_id: 953987
description:
2025-11-15 10:55:26 dovecot_plain authenticator failed for ([31.57.166.48]) [105.186.239.214]:44278: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.217.207.48
country_id: 3996063
description:
2025-11-15 10:55:53 dovecot_plain authenticator failed for ([31.57.166.48]) [189.217.207.48]:52054: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.193.229.3
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.193.229.3 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.163.189.181
country_id: 3996063
description:
2025-11-15 10:56:38 dovecot_plain authenticator failed for ([31.57.166.48]) [164.163.189.181]:38990: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.155.94.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.155.94.28 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.36.17.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.36.17.135 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.9.187.52
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.9.187.52 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.106.220.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.106.220.127 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.133.58
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.175.133.58 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.192.12.59
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.192.12.59 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.143
country_id: 6290252
description:
Nov 15 10:59:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=109.206.98.143, lip=66.85.158.91, TLS, session=<zyOSZZtDt5JtzmKP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.142
country_id: 1269750
description:
Nov 15 10:59:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=103.59.134.142, lip=66.85.158.91, TLS, session=<zwivZZtDar1nO4aO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.48
country_id: 3175395
description:
Nov 15 10:59:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.208.189.48, lip=66.85.158.91, TLS, session=<siGDZJtD2oW50L0w>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.217
country_id: 3865483
description:
Nov 15 10:59:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.181.101.217, lip=66.85.158.91, TLS, session=<i2lmZJtDGcy+tWXZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.252.132.0
country_id: 102358
description:
2025-11-15 11:00:21 dovecot_plain authenticator failed for ([31.57.166.48]) [51.252.132.0]:1050: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.92.253.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.92.253.202 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.48.235.156
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.48.235.156 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.184.47.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.184.47.57 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.96.247.25
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.96.247.25 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.44.144.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.44.144.143 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.170.206.46
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.170.206.46 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.100.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 35.144.100.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.251.191.162
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.251.191.162 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.90.23.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.90.23.111 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.191.28.88
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.191.28.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.232.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.132.232.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.250.100.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.250.100.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.179.6.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 198.179.6.154 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.19
country_id: 2635167
description:
Nov 15 11:02:48 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.19, lip=66.85.158.92, TLS, session=<2k7QcZtDP61X7LAT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 11:03:57 host2 sshd[383187]: Disconnected from invalid user admin 2.57.121.112 port 35129 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.3
country_id: 1880251
description:
Nov 15 11:04:36 host2 sshd[383612]: Disconnected from invalid user shoutcast 45.78.193.3 port 59282 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.185.41.235
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.185.41.235 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.141.122.158
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.141.122.158 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.176.251.233
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 166.176.251.233 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.219.175.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 32.219.175.87 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.39.79.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.39.79.225 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.196.214.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.196.214.35 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.151.134.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.151.134.75 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.3
country_id: 1880251
description:
Nov 15 11:07:15 host2 sshd[385388]: Disconnected from invalid user noel 45.78.193.3 port 40440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.3
country_id: 1880251
description:
Nov 15 11:09:50 host2 sshd[387136]: Disconnected from invalid user nick 45.78.193.3 port 58748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:10:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<n0wDjJtDqukDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.29
country_id: 1819730
description:
Nov 15 11:14:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.29, lip=66.85.158.92, session=<De9VnJtDJC4tjpod>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 15 11:17:46 host2 sshd[394910]: Disconnected from invalid user developer 5.182.83.231 port 59084 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 15 11:20:03 host2 sshd[397028]: Disconnected from invalid user ceo 5.182.83.231 port 48540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-15 11:21:04 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:55192: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-15 11:21:27 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:35564: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.184.226.35
country_id: 3865483
description:
Nov 15 11:21:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=190.184.226.35, lip=66.85.158.91, TLS, session=<U0oxtJtDsMC+uOIj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.216.244.109
country_id: 3469034
description:
2025-11-15 11:21:10 dovecot_plain authenticator failed for ([31.57.166.48]) [186.216.244.109]:53826: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.53.36.78
country_id: 2510769
description:
Nov 15 11:21:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=195.53.36.78, lip=66.85.158.91, TLS, session=<UoAOs5tDsAzDNSRO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.189.80.73
country_id: 2510769
description:
2025-11-15 11:22:43 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:3035: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 15 11:22:20 host2 sshd[398825]: Disconnected from invalid user filippo 5.182.83.231 port 41474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-11-15 11:22:28 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:33462: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.109.62
country_id: 1522867
description:
2025-11-15 11:24:13 dovecot_plain authenticator failed for 37.151.109.62.dynamic.telecom.kz ([31.57.166.48]) [37.151.109.62]:36052: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.0
country_id: 3017382
description:
Nov 15 11:24:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=91.196.152.0, lip=66.85.158.91, session=<PUPiwJtDRYhbxJgA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.3
country_id: 1880251
description:
Nov 15 11:25:09 host2 sshd[400772]: Disconnected from invalid user mohsen 45.78.193.3 port 52896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.81
country_id: 6252001
description:
Nov 15 11:25:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.81, lip=66.85.158.91, TLS: Connection closed, session=<7IoFwptDcBfHLZtR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.90
country_id: 3017382
description:
Nov 15 11:25:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=91.196.152.90, lip=66.85.158.91, session=<RF0RwptDsdlbxJha>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.185.43.134
country_id: 6252001
description:
2025-11-15 11:28:13 dovecot_plain authenticator failed for ([31.57.166.48]) [72.185.43.134]:33112: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-15 11:31:03 dovecot_login authenticator failed for ([201.15.149.254]) [201.15.149.254]:36178: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.208.141.204
country_id: 2245662
description:
2025-11-15 11:30:32 dovecot_plain authenticator failed for ([31.57.166.48]) [41.208.141.204]:51740: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.193.140.76
country_id: 6252001
description:
2025-11-15 11:30:41 dovecot_login authenticator failed for ([71.193.140.76]) [71.193.140.76]:43172: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.84.28.9
country_id: 3865483
description:
2025-11-15 11:36:25 dovecot_plain authenticator failed for ([31.57.166.48]) [181.84.28.9]:55222: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.220.160.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 206.220.160.34 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.10.251.8
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.10.251.8 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.226.161.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.226.161.55 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.135.81.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.135.81.201 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.182.157
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.182.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.75.92.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.75.92.230 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.191.100.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.191.100.147 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.212.242
country_id: 1282988
description:
2025-11-15 11:41:06 dovecot_plain authenticator failed for ([31.57.166.48]) [103.77.212.242]:47502: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.212.242
country_id: 1282988
description:
2025-11-15 11:41:13 dovecot_login authenticator failed for ([31.57.166.48]) [103.77.212.242]:47502: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.126.164.201
country_id: 3469034
description:
2025-11-15 11:43:05 dovecot_plain authenticator failed for ([31.57.166.48]) [179.126.164.201]:62271: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.126.164.201
country_id: 3469034
description:
2025-11-15 11:43:12 dovecot_login authenticator failed for ([31.57.166.48]) [179.126.164.201]:62271: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.202
country_id: 6252001
description:
Nov 15 11:43:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<G1p+BJxDWd7N0h/K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.230.9.42
country_id: 3865483
description:
2025-11-15 11:45:01 dovecot_plain authenticator failed for ([31.57.166.48]) [45.230.9.42]:47938: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.230.9.42
country_id: 3865483
description:
2025-11-15 11:45:08 dovecot_login authenticator failed for ([31.57.166.48]) [45.230.9.42]:47938: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 11:47:20 host2 sshd[418231]: Disconnected from invalid user admin 2.57.121.112 port 7049 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:48:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SrMHFpxDmMYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:49:27 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<gfqeGJxD3usDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:50:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<o+j/GpxDZIsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:51:44 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6SDTIJxDJNADgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 11:51:57 host2 sshd[421441]: Disconnected from invalid user user 2.57.121.25 port 9607 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:53:11 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<4kgBJpxDVugDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 15 11:53:21 host2 sshd[422491]: Disconnected from invalid user bbs 122.166.49.42 port 55716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.250.107
country_id: 798544
description:
Nov 15 11:53:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=109.125.250.107, lip=66.85.158.91, TLS, session=<bilqJ5xDaIZtffpr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.45.200.87
country_id: 2077456
description:
2025-11-15 11:54:14 dovecot_login authenticator failed for ([203.45.200.87]) [203.45.200.87]:60717: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.199.226.121
country_id: 3625428
description:
Nov 15 11:54:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=190.199.226.121, lip=66.85.158.91, TLS, session=<dx+UKJxD7cS+x+J5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:54:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Skv2KZxDVLIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:55:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OiA8LZxD7uMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.1.210.141
country_id: 3686110
description:
2025-11-15 11:56:03 dovecot_plain authenticator failed for ([31.57.166.48]) [179.1.210.141]:59809: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.56.170.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.56.170.87 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.14.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.14.180 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.95.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.37.95.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.15.44.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.15.44.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.58.196.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.58.196.202 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.1.210.141
country_id: 3686110
description:
2025-11-15 11:56:09 dovecot_login authenticator failed for ([31.57.166.48]) [179.1.210.141]:59809: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.55.152.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 143.55.152.89 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 15 11:56:44 host2 sshd[425703]: Disconnected from invalid user schueler 122.166.49.42 port 50092 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:57:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<P64GNpxDZJcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 15 11:58:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<PAj3N5xDIpkDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 15 11:58:26 host2 sshd[426915]: Disconnected from invalid user lch 122.166.49.42 port 53014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Nov 15 12:00:24 host2 sshd[428601]: Disconnected from invalid user admin 196.189.237.92 port 38508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:02:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sDNnRpxDoqQDjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.9.107.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.9.107.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.45.26.86
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.45.26.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.64.10.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.64.10.36 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.173.200.109
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.173.200.109 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.106.112.22
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.106.112.22 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.118.183.98
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.118.183.98 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.206.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.4.206.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.127.214.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.127.214.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.170.55.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.170.55.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.63.163.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.63.163.16 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.145.215
country_id: 6252001
description:
[2025-11-15 12:03:58 +0530] info [whostmgrd] 73.241.145.215 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:03:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AzjvSZxD/q0DjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.70.1.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.70.1.103 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.73.97.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.73.97.138 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.66.69.141
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 207.66.69.141 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:05:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<J3pfUJxD9JYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.18
country_id: 6252001
description:
Nov 15 12:05:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=45.33.109.18, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<qdqcUpxDGM8tIW0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.234.113.143
country_id: 798544
description:
Nov 15 12:05:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=84.234.113.143, lip=66.85.158.91, TLS, session=<TlBAUpxDLAlU6nGP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:05:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1rGhU5xDdNoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.4
country_id: 6252001
description:
Nov 15 12:06:04 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.4, lip=66.85.158.92, TLS, session=<EuEOVJxDHj9C5DUE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.133
country_id: 2300660
description:
Nov 15 12:06:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=41.139.47.133, lip=66.85.158.91, TLS, session=<quNoU5xDbI8piy+F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.103
country_id: 6252001
description:
Nov 15 12:06:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.103, lip=66.85.158.92, TLS, session=<tvOnVZxD6vfG6xhn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 15 12:06:48 host2 sshd[434137]: Disconnected from invalid user system 122.166.49.42 port 39480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:07:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<buW4V5xDwMoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:07:15 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<pUdMWJxDgtgDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov 15 12:08:46 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sKu5XZxD/HjUZija>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:08:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<x+8OXpxDgKoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:09:45 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<11E8YZxD6IEDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.237.92
country_id: 337996
description:
Nov 15 12:10:17 host2 sshd[436862]: Disconnected from invalid user schueler 196.189.237.92 port 34584 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:10:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<VeljZZxDPJoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:11:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<he3vZpxDzMwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:12:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ODm3a5xDQoADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 15 12:13:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<UsQBbpxDUMYDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-15 12:15:32 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:13432: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-15 12:15:55 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:40752: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.187.111.18
country_id: 3469034
description:
2025-11-15 12:16:25 dovecot_plain authenticator failed for ([31.57.166.48]) [45.187.111.18]:57571: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.32.95.94
country_id: 6252001
description:
2025-11-15 12:17:33 dovecot_plain authenticator failed for ([31.57.166.48]) [76.32.95.94]:22489: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 12:20:17 host2 sshd[444481]: Disconnected from invalid user admin 2.57.121.112 port 16379 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Nov 15 12:20:23 host2 sshd[444663]: Disconnected from invalid user rstudio 196.189.237.92 port 46008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.195.83.101
country_id: 2510769
description:
2025-11-15 12:21:47 dovecot_plain authenticator failed for ([31.57.166.48]) [213.195.83.101]:8890: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.92.146.190
country_id: 6252001
description:
2025-11-15 12:24:25 dovecot_plain authenticator failed for ([31.57.166.48]) [73.92.146.190]:59602: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Nov 15 12:25:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.92, TLS, session=<rOMHmpxDivSs7OQm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.1.86
country_id: 798544
description:
Nov 15 12:28:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=89.186.1.86, lip=66.85.158.91, TLS, session=<D7KBpJxDP+xZugFW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.185
country_id: 3277605
description:
Nov 15 12:29:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=188.246.73.185, lip=66.85.158.91, TLS, session=<IaSNpZxDMBK89km5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.89.255.228
country_id: 3144096
description:
2025-11-15 12:30:33 dovecot_plain authenticator failed for ti0023a400-5305.bb.online.no ([31.57.166.48]) [88.89.255.228]:61339: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-15 12:32:49 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:44172: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-15 12:33:10 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:55072: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.183.1.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.183.1.36 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.108.3
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.32.108.3 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.153.50.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 164.153.50.72 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.52.228.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.52.228.73 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.235.70.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.235.70.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.172.206.66
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.172.206.66 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.239.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.158.239.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 12:35:41 host2 sshd[456384]: Disconnected from invalid user user 2.57.121.25 port 13834 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.56
country_id: 6252001
description:
Nov 15 12:36:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.56, lip=66.85.158.91, TLS, session=<cagcwpxDwvXN0h84>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.16.149.163
country_id: 1522867
description:
2025-11-15 12:37:00 dovecot_plain authenticator failed for ([31.57.166.48]) [46.16.149.163]:37382: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.16.149.163
country_id: 1522867
description:
2025-11-15 12:37:07 dovecot_login authenticator failed for ([31.57.166.48]) [46.16.149.163]:37382: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 15 12:38:07 host2 sshd[458283]: Disconnected from invalid user admin 50.225.176.238 port 60904 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.84.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.196.84.251 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.97.89.81
country_id: 290557
description:
2025-11-15 12:43:01 dovecot_plain authenticator failed for bba-86-97-89-81.alshamil.net.ae ([31.57.166.48]) [86.97.89.81]:40894: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.103.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.36.103.54 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.22.164
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.202.22.164 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.164.166.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.164.166.123 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.17.116.58
country_id: 2464461
description:
2025-11-15 12:43:57 dovecot_plain authenticator failed for ([31.57.166.48]) [197.17.116.58]:52014: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.97.89.81
country_id: 290557
description:
2025-11-15 12:43:08 dovecot_login authenticator failed for bba-86-97-89-81.alshamil.net.ae ([31.57.166.48]) [86.97.89.81]:40894: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.212.57.192
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.212.57.192 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.169.210.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.169.210.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.181.123.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.181.123.218 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.4.195.208
country_id: 3469034
description:
2025-11-15 12:44:46 dovecot_plain authenticator failed for 201-4-195-208.user3p.veloxzone.com.br ([31.57.166.48]) [201.4.195.208]:45766: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.244.69
country_id: 1282988
description:
2025-11-15 12:44:45 dovecot_plain authenticator failed for ([31.57.166.48]) [103.225.244.69]:2376: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 15 12:45:41 host2 sshd[464933]: Disconnected from invalid user frontend 50.225.176.238 port 35642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 15 12:46:44 host2 sshd[465686]: Disconnected from invalid user ftpuser 50.225.176.238 port 50030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.75.194.50
country_id: 6251999
description:
2025-11-15 12:47:39 dovecot_plain authenticator failed for s0106f85e42ce2a3a.lb.shawcable.net ([31.57.166.48]) [70.75.194.50]:46528: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 15 12:47:48 host2 sshd[466762]: Disconnected from invalid user toto 50.225.176.238 port 42010 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 15 12:49:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, session=<cPyV7pxDXOnG6xhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.201.220.27
country_id: 3017382
description:
2025-11-15 12:49:24 dovecot_plain authenticator failed for 27.220.201.77.rev.sfr.net ([31.57.166.48]) [77.201.220.27]:48972: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.196.125.247
country_id: 3175395
description:
Nov 15 12:49:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=62.196.125.247, lip=66.85.158.91, TLS, session=<pkCM7pxDGbc+xH33>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.53.36.10
country_id: 2510769
description:
Nov 15 12:49:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=195.53.36.10, lip=66.85.158.91, TLS, session=<qMui75xDyp7DNSQK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.114.6.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.114.6.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.191.17.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.191.17.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.126.103.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.126.103.218 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.63.197.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.63.197.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.120.92.153
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.120.92.153 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.72.72.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 206.72.72.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.93.179.18
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.93.179.18 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.205.220.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.205.220.11 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.222.91.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.222.91.89 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.254.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.90.254.225 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.116.249.115
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.116.249.115 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.173.194.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.173.194.147 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.194.94.71
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.194.94.71 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.204.28.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 97.204.28.195 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.136.50.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.136.50.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.36.234.192
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.36.234.192 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.172.4.9
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 104.172.4.9 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.248.193.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.248.193.151 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.221.60.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.221.60.186 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.131.116.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.131.116.252 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.154.170
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.148.154.170 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.66.13.49
country_id: 6252001
description:
2025-11-15 12:57:15 dovecot_plain authenticator failed for ([31.57.166.48]) [216.66.13.49]:35016: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 12:57:19 host2 sshd[474515]: Disconnected from invalid user stephan 62.60.131.157 port 36064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.7.4.194
country_id: 298795
description:
2025-11-15 12:57:22 dovecot_plain authenticator failed for ([31.57.166.48]) [95.7.4.194]:3680: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.244.158.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.244.158.35 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.83.194.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.83.194.111 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.166.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.148.166.207 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.182.247.74
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.182.247.74 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.225.13.131
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.225.13.131 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.168.18.49
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.168.18.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-15 13:06:36 dovecot_plain authenticator failed for (fulaintrud) [46.8.240.26]:48844: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-15 13:06:39 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (fixes) [73.145.107.251]:52562: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.166.155.166
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 165.166.155.166 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.110.244.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.110.244.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.53.136.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 38.53.136.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.98.5
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.0.98.5 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.73.103.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.73.103.68 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.9.240.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.9.240.75 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-15 13:13:33 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:37124: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-11-15 13:13:54 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:33554: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.150.253.203
country_id: 6252001
description:
2025-11-15 13:15:58 dovecot_plain authenticator failed for ([31.57.166.48]) [35.150.253.203]:6268: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Nov 15 13:16:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.91, TLS: Connection closed, session=<i3qwTp1DsonCpGsG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 13:20:45 host2 sshd[493055]: Disconnected from invalid user  2.57.121.112 port 62752 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.16.252.86
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.16.252.86 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.4.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.185.4.250 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.76.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.76.217 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.6.132.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.6.132.65 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.228.74
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.149.228.74 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.214.47.23
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.214.47.23 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.11.17
country_id: 798544
description:
Nov 15 13:25:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=89.186.11.17, lip=66.85.158.91, TLS, session=<+AXPb51D8rNZugsR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.197.40
country_id: 2510769
description:
Nov 15 13:25:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=45.135.197.40, lip=66.85.158.91, TLS, session=<+Hq4bp1Dd4sth8Uo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.31.223.170
country_id: 3865483
description:
2025-11-15 13:31:37 dovecot_plain authenticator failed for ([31.57.166.48]) [181.31.223.170]:47158: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.228.242.200
country_id: 3865483
description:
2025-11-15 13:31:45 dovecot_plain authenticator failed for ([31.57.166.48]) [181.228.242.200]:33561: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 15 13:34:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS: Connection closed, session=<1goykJ1DzitChJmH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-15 13:37:04 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:33465: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 13:36:07 host2 sshd[504399]: Disconnected from invalid user admin 2.57.121.112 port 8540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-15 13:36:50 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:57038: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Nov 15 13:40:53 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.55, lip=66.85.158.91, TLS: Connection closed, session=<w/0qp51DvmCnXpI3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.250.111
country_id: 3469034
description:
Nov 15 13:45:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.92.250.111, lip=66.85.158.91, TLS, session=<cjAbuJ1DtrCxXPpv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.207.52.14
country_id: 798544
description:
Nov 15 13:46:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.207.52.14, lip=66.85.158.91, TLS, session=<cz41uZ1Duq5bzzQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.17
country_id: 6252001
description:
Nov 15 13:55:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<IzjG3J1DBOO58uIR>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 13:56:28 host2 sshd[519987]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 15 13:56:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<fQoW4J1DqklChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.95
country_id: 6252001
description:
2025-11-15 14:01:32 dovecot_login authenticator failed for ([70.174.168.95]) [70.174.168.95]:35107: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-15 14:01:53 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:41252: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 34.27.42.6 - fhbhealt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 14:05:22 host2 sshd[527115]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 14:06:28 host2 sshd[527892]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.108
country_id: 6252001
description:
Nov 15 14:11:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.155.108, lip=66.85.158.92, TLS: Connection closed, session=<2zHEE55DhEnHLZts>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 14:12:52 host2 sshd[532952]: Disconnected from invalid user stone 62.60.131.157 port 27818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 14:18:58 host2 sshd[537632]: Disconnected from invalid user admin 2.57.121.112 port 33121 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.46
country_id: 3469034
description:
Nov 15 14:21:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=191.240.37.46, lip=66.85.158.91, TLS, session=<+1ncOJ5D8rm/8CUu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.81
country_id: 732800
description:
Nov 15 14:22:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=185.253.159.81, lip=66.85.158.91, TLS, session=</QwIOp5DoNG5/Z9R>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 14:24:55 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50931: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 15 14:36:00 host2 sshd[551680]: Disconnected from invalid user tatyana 4.211.84.189 port 44072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 15 14:36:45 host2 sshd[552246]: Disconnected from invalid user bill 187.62.87.27 port 44164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.248.192.204
country_id: 1269750
description:
Nov 15 14:39:06 host2 sshd[554502]: Invalid user cloudtourssrilan_travel from 49.248.192.204 port 54486


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:39:51 host2 sshd[555021]: Disconnected from invalid user etq 103.28.57.98 port 30744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 15 14:39:58 host2 sshd[555083]: Disconnected from invalid user tatyana 154.83.15.200 port 57248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 15 14:41:34 host2 sshd[556563]: Disconnected from invalid user tatyana 187.62.87.27 port 39114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 15 14:41:38 host2 sshd[556604]: Disconnected from invalid user code 4.211.84.189 port 44132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Nov 15 14:42:28 host2 sshd[557253]: Disconnected from invalid user bill 196.28.242.198 port 56664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.82
country_id: 3469034
description:
Nov 15 14:42:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.120.72.82, lip=66.85.158.91, TLS, session=<ET5ggp5DWI+7eEhS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.38
country_id: 798544
description:
Nov 15 14:42:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.231.121.38, lip=66.85.158.91, TLS, session=<MZaag55Dzcpb53km>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Nov 15 14:43:14 host2 sshd[557842]: Disconnected from invalid user steam 103.139.59.214 port 43198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Nov 15 14:44:07 host2 sshd[558587]: Disconnected from invalid user steam 196.28.242.198 port 53812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.59.214
country_id: 1269750
description:
Nov 15 14:44:30 host2 sshd[558891]: Disconnected from invalid user bill 103.139.59.214 port 41388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 15 14:45:09 host2 sshd[559574]: Disconnected from invalid user devuser 154.83.15.200 port 56096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 15 14:46:20 host2 sshd[560998]: Disconnected from invalid user rajeev 4.211.84.189 port 36014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Nov 15 14:47:25 host2 sshd[561875]: Disconnected from invalid user jack 196.28.242.198 port 39252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:47:36 host2 sshd[561994]: Disconnected from invalid user song 103.28.57.98 port 53478 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 15 14:47:37 host2 sshd[562010]: Disconnected from invalid user demo 154.83.15.200 port 55510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 15 14:47:12 host2 sshd[561708]: Disconnected from invalid user jack 187.62.87.27 port 42186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 14:51:31 host2 sshd[564870]: Disconnected from invalid user admin 2.57.121.112 port 56680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:52:12 host2 sshd[565440]: Disconnected from invalid user deployer 103.28.57.98 port 46503 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:53:46 host2 sshd[566484]: Disconnected from invalid user steam 103.28.57.98 port 61357 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-11-15 14:54:07 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:58969: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-15 14:54:33 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:50241: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.28.57.98
country_id: 1643084
description:
Nov 15 14:56:56 host2 sshd[569524]: Disconnected from invalid user admin 103.28.57.98 port 39526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 15:07:49 host2 sshd[578075]: Disconnected from invalid user  2.57.121.112 port 61274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 15:11:24 host2 sshd[580947]: Disconnected from invalid user stone 62.60.131.157 port 17327 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-11-15 15:24:01 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:49633: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.208.55
country_id: 6252001
description:
2025-11-15 15:24:10 dovecot_login authenticator failed for ([216.21.208.55]) [216.21.208.55]:41964: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.76.37.39
country_id: 6252001
description:
[2025-11-15 15:26:58 +0530] info [cpaneld] 148.76.37.39 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.78.140.132
country_id: 6252001
description:
[2025-11-15 15:26:30 +0530] info [cpaneld] 74.78.140.132 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.132.74.210
country_id: 6252001
description:
[2025-11-15 15:26:46 +0530] info [cpaneld] 35.132.74.210 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.153.95
country_id: 6252001
description:
[2025-11-15 15:26:48 +0530] info [whostmgrd] 23.243.153.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.18.211.63
country_id: 6252001
description:
[2025-11-15 15:26:53 +0530] info [cpaneld] 70.18.211.63 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.136.238.55
country_id: 6252001
description:
[2025-11-15 15:26:56 +0530] info [cpaneld] 71.136.238.55 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.189.247.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.189.247.209 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.137.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.111.137.13 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.36.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.150.36.214 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.187.170.56
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 184.187.170.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.129.130.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.129.130.219 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.217.160.5
country_id: 390903
description:
2025-11-15 15:31:49 dovecot_plain authenticator failed for ([31.57.166.48]) [31.217.160.5]:17959: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.180.162
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.148.180.162 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.103.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.48.103.48 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.246.120.138
country_id: 3469034
description:
2025-11-15 15:32:25 dovecot_plain authenticator failed for ([31.57.166.48]) [170.246.120.138]:6592: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.49.89.39
country_id: 1694008
description:
Nov 15 15:32:44 host2 sshd[597259]: Disconnected from invalid user wireguard 161.49.89.39 port 41340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.116.0.248
country_id: 6252001
description:
2025-11-15 15:33:14 dovecot_plain authenticator failed for c-73-116-0-248.hsd1.ca.comcast.net ([31.57.166.48]) [73.116.0.248]:41242: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 15:34:42 host2 sshd[598458]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 15:34:20 host2 sshd[598243]: Disconnected from invalid user admin 2.57.121.112 port 50802 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.49.89.39
country_id: 1694008
description:
Nov 15 15:38:39 host2 sshd[601328]: Disconnected from invalid user admin 161.49.89.39 port 54162 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.84.5.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.84.5.4 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.230.5.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.230.5.188 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.155.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.155.26 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.187.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.187.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.85.34.172
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.85.34.172 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.140.2.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.140.2.207 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.77.126.249
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.77.126.249 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.49.89.39
country_id: 1694008
description:
Nov 15 15:40:07 host2 sshd[602462]: Disconnected from invalid user filezilla 161.49.89.39 port 57358 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.75.72.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.75.72.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.93.157.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.93.157.219 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.164.134.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.164.134.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.142.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.9.142.201 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.3.79.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.3.79.92 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.103.206.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.103.206.80 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.12.135
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.39.12.135 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.29
country_id: 6252001
description:
Nov 15 15:42:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.29, lip=66.85.158.92, session=<hOajWp9DnIgs3Lkd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.253.6.231
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.253.6.231 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.121.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 216.26.121.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.233.175.70
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.233.175.70 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.53.148.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.53.148.79 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.179.70.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.179.70.26 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.224.145.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.224.145.144 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.217.2.228
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 206.217.2.228 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 15:44:39 host2 sshd[605602]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-15 15:47:57 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:43451: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-11-15 15:48:28 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:52148: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.39.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.51.39.6 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.92.162.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.92.162.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.183.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.132.183.217 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.56.18.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.56.18.51 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.130.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.130.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.28.43.76
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 96.28.43.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.162.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.150.162.143 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.150
country_id: 3175395
description:
Nov 15 15:57:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=217.26.179.150, lip=66.85.158.91, TLS, session=<OfYRjZ9DidDZGrOW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.149
country_id: 953987
description:
Nov 15 15:57:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.64.34.149, lip=66.85.158.91, TLS, session=<IYA6jp9DcrBmQCKV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.247.93
country_id: 1733045
description:
2025-11-15 15:57:49 dovecot_plain authenticator failed for ([31.57.166.48]) [182.62.247.93]:43434: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.176.105.48
country_id: 3469034
description:
2025-11-15 16:00:46 dovecot_plain authenticator failed for ([31.57.166.48]) [45.176.105.48]:6485: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.155
country_id: 6252001
description:
Nov 15 16:04:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.155, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ekO8qZ9DaM4s3Lyb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.102.159.188
country_id: 3175395
description:
Nov 15 16:04:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=62.102.159.188, lip=66.85.158.91, TLS, session=<sOYPqZ9DXM4+Zp+8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.204.148
country_id: 294640
description:
2025-11-15 16:05:04 dovecot_plain authenticator failed for ([31.57.166.48]) [147.235.204.148]:4779: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.80
country_id: 3469034
description:
Nov 15 16:04:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.246.80, lip=66.85.158.91, TLS, session=<VUL3p59DC+m60fZQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.204.148
country_id: 294640
description:
2025-11-15 16:05:11 dovecot_login authenticator failed for ([31.57.166.48]) [147.235.204.148]:4779: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.208
country_id: 2635167
description:
Nov 15 16:05:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.208, lip=66.85.158.92, TLS handshaking: Connection closed, session=<K/3PrZ9D4+pX7LDQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.63
country_id: 2635167
description:
Nov 15 16:05:54 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.63, lip=66.85.158.92, TLS, session=<JtzBrZ9Dec6594k/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.202
country_id: 2635167
description:
Nov 15 16:07:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KPXGsZ9Dxbe594nK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.30.127.249
country_id: 6252001
description:
2025-11-15 16:07:03 dovecot_plain authenticator failed for ([31.57.166.48]) [199.30.127.249]:58395: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.205
country_id: 2635167
description:
Nov 15 16:06:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.205, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YX3Lr59DY62594nN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 16:06:59 host2 sshd[622777]: Disconnected from invalid user admin 2.57.121.112 port 50709 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.30.127.249
country_id: 6252001
description:
2025-11-15 16:07:09 dovecot_login authenticator failed for ([31.57.166.48]) [199.30.127.249]:58395: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.204
country_id: 2635167
description:
Nov 15 16:07:34 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.204, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<lYbCs59Ds61X7LDM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.198
country_id: 2635167
description:
Nov 15 16:08:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.198, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<2NG9tZ9DratX7LDG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.208
country_id: 2635167
description:
Nov 15 16:08:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.208, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fCC3t59Dh4G594nQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.40.240.34
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.40.240.34 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.106.237.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.106.237.77 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.45.197.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.45.197.35 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.247.37.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 63.247.37.60 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.204
country_id: 2635167
description:
Nov 15 16:09:47 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.204, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<hu2vu59DYZxX7LDM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.212
country_id: 2635167
description:
Nov 15 16:09:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.212, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<XmC0uZ9D7ci594nU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.238.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.238.102 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.246.170.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.246.170.178 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.213
country_id: 2635167
description:
Nov 15 16:10:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<3ESpvZ9DL+W594nV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.195
country_id: 2635167
description:
Nov 15 16:10:54 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<iqCkv59Du+JX7LDD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.34.101.182
country_id: 3469034
description:
2025-11-15 16:12:59 dovecot_plain authenticator failed for ([31.57.166.48]) [187.34.101.182]:35662: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.125
country_id: 3469034
description:
Nov 15 16:16:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=186.209.248.125, lip=66.85.158.91, TLS, session=<b9ut0Z9DV6q60fh9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.95
country_id: 3469034
description:
Nov 15 16:16:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=191.240.36.95, lip=66.85.158.91, TLS, session=<OAHa0p9DaJO/8CRf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.33.45.209
country_id: 6252001
description:
2025-11-15 16:17:43 dovecot_plain authenticator failed for ([31.57.166.48]) [47.33.45.209]:58990: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.104.224.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.104.224.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.10.228.165
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.10.228.165 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.207.116.157
country_id: 2635167
description:
2025-11-15 16:19:04 dovecot_plain authenticator failed for gamma.climatec-windows.co.uk (unktain) [92.207.116.157]:47863: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.18.93.167
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.18.93.167 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.7.100.81
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.7.100.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.102.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 12.74.102.16 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.203.36.42
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.203.36.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.113.191.196
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.113.191.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.244.49.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.244.49.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.203.30.224
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.203.30.224 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.24.236.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.24.236.102 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.56.214.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.56.214.64 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.15.156.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 184.15.156.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.175.109.153
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.175.109.153 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.122.203.90
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.122.203.90 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.240.185
country_id: 289688
description:
2025-11-15 16:21:48 dovecot_plain authenticator failed for ([31.57.166.48]) [37.210.240.185]:43923: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 16:22:37 host2 sshd[633869]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.116.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.164.116.176 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.184.137.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.184.137.55 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.93.42.27
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.93.42.27 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.136.226.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 40.136.226.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.135.148.240
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.135.148.240 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.97.235
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.207.97.235 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.36.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.150.36.214 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.74.222.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.74.222.105 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.82
country_id: 3469034
description:
Nov 15 16:25:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.120.72.82, lip=66.85.158.91, TLS, session=<jGbH8p9Dp7W7eEhS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.133.16.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.133.16.67 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.181
country_id: 3175395
description:
Nov 15 16:25:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.169.181, lip=66.85.158.91, TLS, session=<74EN9J9Dv6W5D6m1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.94.220.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.94.220.84 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.96.88.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.96.88.243 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.171.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.4.171.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.85.96.58
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 69.85.96.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.135.223.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.135.223.54 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.215.163.118
country_id: 1269750
description:
2025-11-15 16:32:47 dovecot_plain authenticator failed for ([31.57.166.48]) [106.215.163.118]:29278: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.93.247
country_id: 6252001
description:
2025-11-15 16:33:07 dovecot_login authenticator failed for (XYxSEM4Wod) [107.175.93.247]:63885: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.93.247
country_id: 6252001
description:
2025-11-15 16:33:14 dovecot_login authenticator failed for (ndfA6BNE) [107.175.93.247]:64175: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.156.218.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.156.218.238 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.251.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.154.251.121 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.213.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.80.213.21 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.32.20.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.32.20.238 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.9.22.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 216.9.22.116 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.88.87.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.88.87.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.162.78.136
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.162.78.136 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.93.247
country_id: 6252001
description:
2025-11-15 16:37:00 dovecot_login authenticator failed for (7RKtOLFB7o) [107.175.93.247]:54091: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.60
country_id: 953987
description:
Nov 15 16:39:25 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.129.57.60, lip=66.85.158.91, TLS, session=<vR2HJKBDK7dmgTk8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.221.148.85
country_id: 3469034
description:
Nov 15 16:39:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=131.221.148.85, lip=66.85.158.91, TLS, session=<2erEJaBD6rCD3ZRV>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.202.151.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.202.151.100 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.50.23.185
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.50.23.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.131.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.176.131.40 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.13.107
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 38.43.13.107 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.24.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.80.24.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.204.115.185
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.204.115.185 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.222.18.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.222.18.134 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.83.88.249
country_id: 6252001
description:
2025-11-15 16:53:28 dovecot_plain authenticator failed for ec2-54-83-88-249.compute-1.amazonaws.com (EC2AMAZ-H0DP7I4.ec2.internal) [54.83.88.249]:50678: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.30.15
country_id: 99237
description:
2025-11-15 16:53:20 dovecot_plain authenticator failed for ([31.57.166.48]) [185.106.30.15]:18525: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.139.134.157
country_id: 6252001
description:
[2025-11-15 16:55:34 +0530] info [cpaneld] 75.139.134.157 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.131.234
country_id: 6252001
description:
[2025-11-15 16:55:42 +0530] info [cpaneld] 204.111.131.234 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.132.64.249
country_id: 6252001
description:
[2025-11-15 16:55:44 +0530] info [cpaneld] 72.132.64.249 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.100.96.40
country_id: 6252001
description:
[2025-11-15 16:55:56 +0530] info [cpaneld] 73.100.96.40 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.183.16.79
country_id: 6252001
description:
[2025-11-15 16:55:47 +0530] info [whostmgrd] 67.183.16.79 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.203.78.126
country_id: 6252001
description:
[2025-11-15 16:55:49 +0530] info [cpaneld] 73.203.78.126 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.183.172
country_id: 6252001
description:
[2025-11-15 16:55:52 +0530] info [cpaneld] 67.188.183.172 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.52
country_id: 798544
description:
2025-11-15 16:57:32 dovecot_login authenticator failed for (mgabCJKh) [45.80.158.52]:56162: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.154.8
country_id: 6252001
description:
[2025-11-15 16:57:57 +0530] info [cpaneld] 76.141.154.8 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.246.212.156
country_id: 6252001
description:
[2025-11-15 16:58:00 +0530] info [cpaneld] 96.246.212.156 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.49.246.141
country_id: 6252001
description:
[2025-11-15 16:58:04 +0530] info [cpaneld] 72.49.246.141 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.70.204.73
country_id: 6252001
description:
[2025-11-15 16:58:06 +0530] info [whostmgrd] 97.70.204.73 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.52
country_id: 798544
description:
2025-11-15 16:58:10 dovecot_login authenticator failed for (jRv7jDhWN) [45.80.158.52]:49870: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.141.66.236
country_id: 6252001
description:
[2025-11-15 16:58:11 +0530] info [cpaneld] 35.141.66.236 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.81.199
country_id: 6252001
description:
[2025-11-15 16:58:14 +0530] info [cpaneld] 47.149.81.199 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.36.211.194
country_id: 6252001
description:
[2025-11-15 16:58:16 +0530] info [cpaneld] 199.36.211.194 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 16:58:26 host2 sshd[663876]: Disconnected from invalid user arely 62.60.131.157 port 53756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 17:00:58 host2 sshd[665846]: Disconnected from invalid user administrator 2.57.121.112 port 62411 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.80.158.52
country_id: 798544
description:
2025-11-15 17:01:30 dovecot_login authenticator failed for (KP0f5iIu52) [45.80.158.52]:55347: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.204
country_id: 6252001
description:
Nov 15 17:17:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.204, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UtnHraBD1rgUQcHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.137.127
country_id: 3144096
description:
2025-11-15 17:18:52 dovecot_login authenticator failed for (cm-178.232.137.127.get.no) [178.232.137.127]:42740: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.90.196.70
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.90.196.70 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.229.88
country_id: 3865483
description:
2025-11-15 17:19:42 dovecot_login authenticator failed for ([190.185.229.88]) [190.185.229.88]:45962: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-15 17:20:50 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:43838: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-15 17:20:57 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:59690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 17:22:52 host2 sshd[681298]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.25
country_id: 3865483
description:
Nov 15 17:23:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=181.191.223.25, lip=66.85.158.91, TLS, session=<ko/Ew6BD19W1v98Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.42.52
country_id: 2395170
description:
Nov 15 17:24:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=154.127.42.52, lip=66.85.158.91, TLS, session=<KVgGxaBDgp+afyo0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.56.179
country_id: 6252001
description:
Nov 15 17:40:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.221.56.179, lip=66.85.158.91, session=<obgk/6BDyKAU3Tiz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.85.171.68
country_id: 732800
description:
Nov 15 17:42:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=77.85.171.68, lip=66.85.158.91, TLS, session=<68DeB6FD+rdNVatE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.16
country_id: 3469034
description:
Nov 15 17:43:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=177.130.168.16, lip=66.85.158.91, TLS, session=<xkgWCaFD1tSxgqgQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.113.68
country_id: 6252001
description:
Nov 15 17:44:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.113.68, lip=66.85.158.92, session=<AW+ADaFDttasynFE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-15 17:46:06 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (deoly) [81.225.30.107]:38983: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.174.225.60
country_id: 6252001
description:
Nov 15 17:51:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.174.225.60, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<n3WJKKFDnLKsruE8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 15 17:53:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<EPRMMKFDev/CpRCn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.173.54
country_id: 6252001
description:
Nov 15 17:56:55 host2 pure-ftpd[706097]: (?@134.209.173.54) [INFO] New connection from 134.209.173.54


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.209.173.54
country_id: 6252001
description:
Nov 15 17:57:02 host2 pure-ftpd[706187]: (?@134.209.173.54) [INFO] New connection from 134.209.173.54


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.254.229.191
country_id: 3686110
description:
Nov 15 17:56:12 host2 sshd[705784]: Disconnected from invalid user himanshu 170.254.229.191 port 59104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 17:58:26 host2 sshd[707086]: Disconnected from invalid user git 172.210.69.152 port 35850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.27.134.52
country_id: 1168579
description:
Nov 15 17:59:05 host2 sshd[707864]: Disconnected from invalid user yyy 58.27.134.52 port 33896 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.254.229.191
country_id: 3686110
description:
Nov 15 18:00:40 host2 sshd[709055]: Disconnected from invalid user user 170.254.229.191 port 42748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 18:01:02 host2 sshd[709386]: Disconnected from invalid user opc 172.210.69.152 port 57762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 15 18:02:04 host2 sshd[710138]: Disconnected from invalid user seekcy 152.32.185.214 port 51108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 18:02:24 host2 sshd[710316]: Disconnected from invalid user wf 172.210.69.152 port 48382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 15 18:03:23 host2 sshd[711275]: Disconnected from invalid user newuser 152.32.185.214 port 43758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.254.229.191
country_id: 3686110
description:
Nov 15 18:03:30 host2 sshd[711319]: Disconnected from invalid user pivpn 170.254.229.191 port 40870 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.180.96
country_id: 2921044
description:
Nov 15 18:03:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.197.180.96, lip=66.85.158.91, session=<UlO9UqFDdrWKxbRg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.156
country_id: 3865483
description:
Nov 15 18:04:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=181.118.183.156, lip=66.85.158.91, TLS, session=<G0MmU6FD1+O1drec>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.72.212
country_id: 2921044
description:
Nov 15 18:03:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.72.212, lip=66.85.158.91, session=<Y7yIUqFD9SBEt0jU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.95
country_id: 3057568
description:
Nov 15 18:03:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=91.226.115.95, lip=66.85.158.91, TLS, session=<EYj3UaFD1r1b4nNf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 18:03:47 host2 sshd[711492]: Disconnected from invalid user postmaster 172.210.69.152 port 54014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.69.152
country_id: 6252001
description:
Nov 15 18:05:17 host2 sshd[712327]: Disconnected from invalid user tarun 172.210.69.152 port 54494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 15 18:08:52 host2 sshd[714165]: Disconnected from invalid user web 152.32.185.214 port 42306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 15 18:11:54 host2 sshd[715819]: Disconnected from invalid user kodi 152.32.185.214 port 38808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 18:13:41 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65489: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:20:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<MkBmjaFDLJwDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:22:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<YJb0lKFDQtoDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:24:19 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<S4jNnKFDULMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:26:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<6SfvoqFDTKADg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 18:26:21 host2 sshd[724209]: Disconnected from invalid user user 2.57.121.25 port 39715 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:26:29 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<BAOGpKFDpLEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 15 18:29:50 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<NTuAsKFDnL8Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.46.17
country_id: 6251999
description:
2025-11-15 18:33:35 dovecot_login authenticator failed for dhcp-b8-94-70-ce-5f-c4.cpe.i-zoom.net [24.137.46.17]:44418: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.15.27.17
country_id: 6252001
description:
Nov 15 18:34:06 host2 sshd[729073]: Disconnected from invalid user teamspeak3 20.15.27.17 port 35422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.19
country_id: 1880251
description:
Nov 15 18:35:05 host2 sshd[729745]: Disconnected from invalid user amir 45.78.198.19 port 37480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.19
country_id: 1880251
description:
Nov 15 18:37:46 host2 sshd[731368]: Disconnected from invalid user systemd 45.78.198.19 port 53912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 15 18:40:56 host2 sshd[733286]: Disconnected from invalid user kaia 62.60.131.157 port 60220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.19
country_id: 1880251
description:
Nov 15 18:40:29 host2 sshd[733063]: Disconnected from invalid user ec2-user 45.78.198.19 port 42754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-15 18:40:33 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:37137: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-15 18:40:47 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:58127: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 18:51:36 host2 sshd[739633]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 18:52:32 host2 sshd[740043]: Disconnected from invalid user admin 2.57.121.112 port 52028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.15.27.17
country_id: 6252001
description:
Nov 15 18:57:29 host2 sshd[743606]: Disconnected from invalid user yanghui 20.15.27.17 port 49022 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 19:01:41 host2 sshd[746107]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.15.27.17
country_id: 6252001
description:
Nov 15 19:01:45 host2 sshd[746135]: Disconnected from invalid user backup 20.15.27.17 port 41010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.76.137
country_id: 3469034
description:
Nov 15 19:01:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.72.76.137, lip=66.85.158.91, TLS, session=<5Vn/IaJDC6+xSEyJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.223
country_id: 3469034
description:
Nov 15 19:02:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=177.44.96.223, lip=66.85.158.91, TLS, session=<erczI6JDptaxLGDf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.15.27.17
country_id: 6252001
description:
Nov 15 19:03:16 host2 sshd[747340]: Disconnected from invalid user ftpuser 20.15.27.17 port 58380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-15 19:26:49 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:49762: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.66.120.237
country_id: 6252001
description:
2025-11-15 19:27:09 dovecot_login authenticator failed for ([209.66.120.237]) [209.66.120.237]:51025: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.127.134.185
country_id: 6252001
description:
[2025-11-15 19:30:27 +0530] info [whostmgrd] 99.127.134.185 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 15 19:36:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<bq8VnqJD1pOLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.186
country_id: 3469034
description:
Nov 15 19:39:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.120.104.186, lip=66.85.158.91, TLS, session=<62o1qKJDLd27eGi6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.107
country_id: 3469034
description:
Nov 15 19:39:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=186.209.248.107, lip=66.85.158.91, TLS, session=<nEBfqaJDpM+60fhr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.20.66.206
country_id: 783754
description:
Nov 15 19:40:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=84.20.66.206, lip=66.85.158.91, TLS, session=<vFnmrKJDiolUFELO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 88.214.16.44
country_id: 783754
description:
Nov 15 19:40:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=88.214.16.44, lip=66.85.158.91, TLS, session=<8PrXq6JDS55Y1hAs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 15 19:48:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZLmbyqJDW/8t4/6c>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.208.7
country_id: 6252001
description:
Nov 15 19:51:54 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.208.7, lip=66.85.158.91, session=<BtD81aJD5pGYINAH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.7
country_id: 6252001
description:
Nov 15 19:51:53 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.208.7, lip=66.85.158.91, session=<K47r1aJDfJGYINAH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.161.60.110
country_id: 6252001
description:
Nov 15 19:56:48 host2 sshd[781567]: Disconnected from invalid user siva 192.161.60.110 port 33122 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.161.60.110
country_id: 6252001
description:
Nov 15 20:01:42 host2 sshd[784374]: Disconnected from invalid user ganesh 192.161.60.110 port 37878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-11-15 20:03:03 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:55328: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 20:03:50 host2 sshd[786175]: Disconnected from invalid user user 2.57.121.25 port 20562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.130.187
country_id: 690791
description:
Nov 15 20:03:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=37.221.130.187, lip=66.85.158.91, TLS, session=<DK8AAKNDAJMl3YK7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-15 20:03:31 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:44922: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.100.202
country_id: 798544
description:
Nov 15 20:03:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=85.202.100.202, lip=66.85.158.91, TLS, session=<ZFKi/qJD/tRVymTK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.161.60.110
country_id: 6252001
description:
Nov 15 20:05:41 host2 sshd[787337]: Disconnected from invalid user it 192.161.60.110 port 47920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.161.60.110
country_id: 6252001
description:
Nov 15 20:09:39 host2 sshd[789300]: Disconnected from invalid user zhangyue 192.161.60.110 port 57958 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 15 20:11:59 host2 sshd[790642]: Disconnecting authenticating user root 5.187.97.40 port 40185: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 15 20:11:59 host2 sshd[790642]: error: maximum authentication attempts exceeded for root from 5.187.97.40 port 40185 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 15 20:12:06 host2 sshd[790732]: Disconnecting invalid user admin 5.187.97.40 port 40869: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.163.10
country_id: 6252001
description:
Nov 15 20:12:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.154.163.10, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gXOgHqNDcoWlmqMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 15 20:13:19 host2 sshd[791388]: Disconnected from invalid user cosmo 27.112.78.245 port 60792 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.190
country_id: 6252001
description:
Nov 15 20:16:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.190, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<8CceL6NDl8STuYS+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.190
country_id: 6252001
description:
Nov 15 20:17:46 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.190, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<Pap/MqNDjPiTuYS+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 15 20:18:49 host2 sshd[794413]: Disconnected from invalid user alpha 27.112.78.245 port 33878 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.190
country_id: 6252001
description:
Nov 15 20:21:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.190, lip=66.85.158.91, TLS, session=<4cXSP6NDCveTuYS+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 15 20:21:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.92, session=<WvdvPqND/MyUccE7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 15 20:22:57 host2 sshd[796701]: Disconnected from invalid user fin 27.112.78.245 port 49340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.83.88.249
country_id: 6252001
description:
2025-11-15 20:28:44 dovecot_plain authenticator failed for ec2-54-83-88-249.compute-1.amazonaws.com (EC2AMAZ-H0DP7I4.ec2.internal) [54.83.88.249]:65065: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov 15 20:28:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1FiBWqNDdTdAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov 15 20:29:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Z+iTW6ND+hpAPsUC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 20:30:43 host2 sshd[801449]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 20:31:57 host2 sshd[801997]: Disconnected from invalid user  2.57.121.112 port 62311 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.155.51
country_id: 3077311
description:
Nov 15 20:38:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=80.82.155.51, lip=66.85.158.91, TLS, session=<vMz3eqNDeaZQUpsz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.232.225.93
country_id: 597427
description:
Nov 15 20:38:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=94.232.225.93, lip=66.85.158.91, TLS, session=<zySifKNDD4Re6OFd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 20:38:13 host2 sshd[805683]: Disconnected from invalid user admin 2.57.121.112 port 62577 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 20:40:48 host2 sshd[807810]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2025-11-15 20:41:17 dovecot_login authenticator failed for ([102.164.35.116]) [102.164.35.116]:50340: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.209.236
country_id: 3175395
description:
Nov 15 20:42:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=94.198.209.236, lip=66.85.158.91, TLS, session=<E94Fi6NDCpRextHs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.45
country_id: 3469034
description:
Nov 15 20:43:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=186.209.246.45, lip=66.85.158.91, TLS, session=<bw4ljKNDL5C60fYt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-11-15 20:43:53 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:57812: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-11-15 20:44:12 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:32826: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov 15 20:46:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<0kW4mKNDihZBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 20:52:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zbNLrqNDvcWi2JYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 20:53:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LzyLsaNDvPmi2JYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 20:54:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<bOwotaND7Pei2JYo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.83.88.249
country_id: 6252001
description:
2025-11-15 20:56:57 dovecot_plain authenticator failed for ec2-54-83-88-249.compute-1.amazonaws.com (EC2AMAZ-H0DP7I4.ec2.internal) [54.83.88.249]:59392: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 21:00:32 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS, session=<TUJ9y6ND3uai2JYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.135.152
country_id: 1733045
description:
Nov 15 21:01:20 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.250.135.152, lip=66.85.158.92, TLS, session=<+rFWzqNDvpEv+oeY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 21:01:44 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS, session=<xBjDz6NDeuqi2JYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.135.152
country_id: 1733045
description:
Nov 15 21:03:50 host2 dovecot[3661788]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=47.250.135.152, lip=66.85.158.92, TLS handshaking, session=<w/Y816NDuJEv+oeY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 15 21:05:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<iMXt26ND8MNChJmO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov 15 21:05:42 host2 sshd[824275]: Disconnected from invalid user runner 58.147.171.11 port 61160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov 15 21:07:39 host2 sshd[825262]: Disconnected from invalid user neil 58.147.171.11 port 35998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.147.171.11
country_id: 1210997
description:
Nov 15 21:09:29 host2 sshd[826255]: Disconnected from invalid user admin 58.147.171.11 port 10810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov 15 21:15:15 host2 sshd[830678]: Disconnected from invalid user transfer 58.147.171.11 port 48290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-11-15 21:18:43 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:32894: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-15 21:18:25 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br (189-44-180-233.customer.tdatabrasil.net.br) [201.61.40.117]:56014: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.35.224.226
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.35.224.226 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.136.148.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.136.148.103 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.155.67.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.155.67.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.142.223.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 40.142.223.251 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.169.127.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.169.127.181 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.6.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.218.6.111 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.143.214.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.143.214.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.169.44.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.169.44.243 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.115.82.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.115.82.79 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.230.226.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.230.226.105 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.225.102.114
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 209.225.102.114 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.94.174.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.94.174.65 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.40.181.202
country_id: 798549
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 89.40.181.202 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.124.119
country_id: 2802361
description:
Nov 15 21:29:25 host2 pure-ftpd[840450]: (?@34.140.124.119) [INFO] New connection from 34.140.124.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.83.88.249
country_id: 6252001
description:
2025-11-15 21:31:28 dovecot_plain authenticator failed for ec2-54-83-88-249.compute-1.amazonaws.com (EC2AMAZ-H0DP7I4.ec2.internal) [54.83.88.249]:52345: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.136.113.72
country_id: 2264397
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 193.136.113.72 - careers@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.197
country_id: 6252001
description:
Nov 15 21:37:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.197, lip=66.85.158.92, session=<qUzhTaRDq2NBMQHF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 15 21:37:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS: Connection closed, session=<WxurTqRDpudBMQHA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-15 21:38:54 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:59950: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-15 21:38:47 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:39803: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.84
country_id: 831053
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.35.67.84 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 21:41:20 host2 sshd[849135]: Disconnected from invalid user admin 2.57.121.112 port 41268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:42:12 host2 sshd[849862]: Disconnected from invalid user talia 72.240.125.133 port 51626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:45:37 host2 sshd[852222]: Disconnected from invalid user wang 72.240.125.133 port 50830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.47
country_id: 1733045
description:
2025-11-15 21:47:18 dovecot_login authenticator failed for ([49.124.153.47]) [49.124.153.47]:49834: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-15 21:47:43 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:39009: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 15 21:48:23 host2 sshd[853963]: Disconnected from invalid user test 104.168.56.59 port 44586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:49:20 host2 sshd[854603]: Disconnected from invalid user gerald 72.240.125.133 port 60476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 15 21:49:34 host2 sshd[854808]: Disconnected from invalid user gerald 104.168.56.59 port 54356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 15 21:51:58 host2 sshd[856968]: Disconnected from invalid user muhamed 104.168.56.59 port 42636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.174
country_id: 3865483
description:
Nov 15 21:52:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.181.101.174, lip=66.85.158.91, TLS, session=<RB3bgqRDRJu+tWWu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.234.125.28
country_id: 798544
description:
Nov 15 21:52:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=84.234.125.28, lip=66.85.158.91, TLS, session=<8/8ShKRD8YlU6n0c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:52:58 host2 sshd[862007]: Disconnected from invalid user test 72.240.125.133 port 41866 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 15 21:53:08 host2 sshd[863281]: Disconnected from invalid user vncuser 104.168.56.59 port 34882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:55:36 host2 sshd[872115]: Disconnected from invalid user vncuser 72.240.125.133 port 48290 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.24.211.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.24.211.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.132.83.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.132.83.51 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.86.131.240
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.86.131.240 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.156.104.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.156.104.15 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.161.177.240
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 67.161.177.240 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.207.210.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.207.210.186 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.84.72.104
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.84.72.104 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 21:58:51 host2 sshd[873730]: Disconnected from invalid user abcd 137.184.30.179 port 40384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-15 22:02:05 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:43273: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-11-15 22:01:43 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:49118: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 22:02:24 host2 sshd[875846]: Disconnected from invalid user testmail 137.184.30.179 port 44802 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 22:03:35 host2 sshd[876748]: Disconnected from invalid user david 137.184.30.179 port 37644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 22:04:46 host2 sshd[877376]: Disconnected from invalid user bot2 137.184.30.179 port 39066 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 22:06:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<uhnXuKRDIOm4aYtF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 22:07:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, TLS: Connection closed, session=<CwGruaRDSPa4aYtF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 22:08:03 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54801: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 22:08:38 host2 sshd[880325]: Disconnected from invalid user ftpuser 137.184.30.179 port 35844 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 22:09:46 host2 sshd[880918]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 15 22:09:22 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<FqigwaRDGv4t4/6c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.66
country_id: 831053
description:
[2025-11-15 22:11:22 +0530] info [cpaneld] 37.35.67.66 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-15 22:12:20 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:57886: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 22:18:16 host2 sshd[886071]: Disconnected from invalid user ubnt 2.57.121.112 port 61885 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 22:19:45 host2 sshd[886747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov 15 22:19:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CGsZ56RDhu9KUi8D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov 15 22:20:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LOZ86KRDnrRKUi8D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 22:23:27 host2 sshd[889093]: Disconnected from invalid user user 2.57.121.25 port 33271 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 22:23:48 host2 sshd[889227]: Disconnected from invalid user ubnt 2.57.121.112 port 62513 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.94.63
country_id: 1269750
description:
Nov 15 22:24:54 host2 sshd[889805]: Invalid user cloudtourssrilan_travel from 139.59.94.63 port 34658


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-15 22:26:07 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:39954: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-15 22:26:14 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:33784: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.204
country_id: 6252001
description:
Nov 15 22:31:36 host2 pure-ftpd[893981]: (?@198.235.24.204) [INFO] New connection from 198.235.24.204


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 15 22:32:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WPqFFaVDIoJAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 15 22:33:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2xXEFqVDusJAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 15 22:40:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<DF/bMKVDCAjCpRCl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 23:04:16 host2 sshd[913301]: Disconnected from invalid user admin 2.57.121.112 port 21743 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.86
country_id: 2635167
description:
Nov 15 23:04:29 host2 pure-ftpd[913391]: (?@185.247.137.86) [INFO] New connection from 185.247.137.86


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.141.27.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.141.27.202 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.130.100.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.130.100.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.59.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 35.144.59.4 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-11-15 23:08:27 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:47128: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.30.127.82
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.30.127.82 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.32.184.9
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.32.184.9 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-11-15 23:08:07 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:57760: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.103
country_id: 3017382
description:
Nov 15 23:12:43 host2 pure-ftpd[918416]: (?@91.196.152.103) [INFO] New connection from 91.196.152.103


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 15 23:16:05 host2 sshd[920431]: Disconnected from invalid user hossein 82.65.43.136 port 54420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.192.10.162
country_id: 1269750
description:
Nov 15 23:17:41 host2 sshd[921311]: Disconnected from invalid user www 20.192.10.162 port 38350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 15 23:20:44 host2 sshd[923105]: Disconnected from invalid user jkkim 82.65.43.136 port 55160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.192.10.162
country_id: 1269750
description:
Nov 15 23:20:50 host2 sshd[923144]: Disconnected from invalid user ftp_user 20.192.10.162 port 37924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 15 23:22:12 host2 sshd[924193]: Disconnected from invalid user fs 152.32.191.75 port 32888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 15 23:23:32 host2 sshd[925043]: Disconnected from invalid user test1234 152.32.191.75 port 53464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 15 23:24:05 host2 sshd[925319]: Disconnected from invalid user ftpuser 82.65.43.136 port 55706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-15 23:24:48 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (mulaing) [81.225.30.107]:46656: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 15 23:26:25 host2 sshd[926763]: Disconnected from invalid user ubuntu 82.65.43.136 port 56080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 15 23:26:42 host2 sshd[926900]: Disconnected from invalid user administrator 152.32.191.75 port 52192 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.1.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.105.1.252 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.134.17.119
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.134.17.119 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.56.77.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.56.77.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.210.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 132.147.210.144 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.75.102.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.75.102.209 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.209.168.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.209.168.251 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.221.36.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.221.36.6 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.181.117.224
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.181.117.224 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.223.242.204
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.223.242.204 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.56.123.249
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.56.123.249 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.253.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.253.214 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:37:04 host2 sshd[932581]: Disconnected from invalid user didi 8.243.64.226 port 56474 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.106.96.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 149.106.96.28 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.60
country_id: 3017382
description:
2025-11-15 23:37:27 dovecot_plain authenticator failed for ([10.17.18.51]) [191.101.31.60]:37563: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:39:08 host2 sshd[933861]: Disconnected from invalid user asad 8.243.64.226 port 59840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:41:06 host2 sshd[935197]: Disconnected from invalid user discord 8.243.64.226 port 37940 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.212.105
country_id: 2921044
description:
Nov 15 23:44:06 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.59.212.105, lip=66.85.158.92, session=<FAFrFKZDZ3KLO9Rp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:43:46 host2 sshd[936539]: Disconnected from invalid user int 8.243.64.226 port 37768 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.212.105
country_id: 2921044
description:
Nov 15 23:44:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.59.212.105, lip=66.85.158.92, session=<+5eBFKZDZT+LO9Rp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.122.8
country_id: 2921044
description:
Nov 15 23:44:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.232.122.8, lip=66.85.158.92, session=<4EOUFKZDHpal6HoI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:45:10 host2 sshd[937836]: Disconnected from invalid user dbseller 8.243.64.226 port 35638 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 23:47:55 host2 sshd[939508]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-15 23:48:39 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:40654: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-15 23:48:54 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:32829: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.182.90.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.182.90.51 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.10.186.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.10.186.37 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.84.47.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.84.47.218 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.21.43
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.185.21.43 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.30.121.46
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.30.121.46 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.17.60.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 8.17.60.146 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.146.67.162
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 206.146.67.162 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 23:59:38 host2 sshd[946736]: Disconnected from invalid user user 2.57.121.25 port 18441 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 00:02:29 host2 sshd[948457]: Disconnected from invalid user admin 2.57.121.112 port 61947 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.17
country_id: 6252001
description:
Nov 16 00:03:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.33.109.17, lip=66.85.158.91, session=<GsZ+WqZDnMUtIW0R>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.166.31
country_id: 2635167
description:
Nov 16 00:11:45 host2 sshd[954786]: Disconnected from invalid user system 138.68.166.31 port 57010 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 16 00:13:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1P0MfqZDi/4t4/6c>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.166.31
country_id: 2635167
description:
Nov 16 00:17:01 host2 sshd[959149]: Disconnected from invalid user rocco 138.68.166.31 port 55536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.166.31
country_id: 2635167
description:
Nov 16 00:18:08 host2 sshd[960079]: Disconnected from invalid user vpn 138.68.166.31 port 55242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Nov 16 00:20:38 host2 sshd[961914]: Disconnected from invalid user btest 170.80.0.4 port 52829 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.160.20
country_id: 3175395
description:
Nov 16 00:21:20 host2 sshd[962232]: Disconnected from invalid user localhost 84.33.160.20 port 51684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.229
country_id: 690791
description:
Nov 16 00:21:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=176.103.0.229, lip=66.85.158.91, TLS, session=<1hq3mKZDtsqwZwDl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.65
country_id: 953987
description:
Nov 16 00:21:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.60.65, lip=66.85.158.91, TLS, session=<liPimaZDDtRmgTxB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.80.0.4
country_id: 3469034
description:
Nov 16 00:24:05 host2 sshd[963499]: Disconnected from invalid user user01 170.80.0.4 port 57241 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 00:25:27 host2 sshd[964416]: Disconnected from invalid user admin 2.57.121.112 port 63556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:26:26 host2 sshd[965027]: Disconnected from invalid user localhost 146.190.144.138 port 38616 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.232
country_id: 6252001
description:
Nov 16 00:29:50 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.232, lip=66.85.158.92, TLS, session=<AYv1t6ZDIuhHBobo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:30:27 host2 sshd[967372]: Disconnected from invalid user test 146.190.144.138 port 42894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.53.220.26
country_id: 1605651
description:
Nov 16 00:31:00 host2 sshd[967602]: Disconnected from invalid user spectrum 182.53.220.26 port 54844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.53.220.26
country_id: 1605651
description:
Nov 16 00:35:03 host2 sshd[969645]: Disconnected from invalid user vikash 182.53.220.26 port 57126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.53.220.26
country_id: 1605651
description:
Nov 16 00:36:22 host2 sshd[970530]: Disconnected from invalid user mirco 182.53.220.26 port 56754 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.238.49
country_id: 2921044
description:
Nov 16 00:36:47 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.90.238.49, lip=66.85.158.91, TLS, session=<pPrO0KZDwiykWu4x>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.53.220.26
country_id: 1605651
description:
Nov 16 00:37:40 host2 sshd[971121]: Disconnected from invalid user user1 182.53.220.26 port 50298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:38:17 host2 sshd[971562]: Disconnected from invalid user teamspeak 146.190.144.138 port 51846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:42:13 host2 sshd[973813]: Disconnected from invalid user rocketmq 146.190.144.138 port 35932 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:44:10 host2 sshd[974803]: Disconnected from invalid user liuhao 146.190.144.138 port 42274 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.236.189.117
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.236.189.117 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.160.176.149
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.160.176.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.210.114
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.93.210.114 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.10.11.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.10.11.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.46.219.194
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.46.219.194 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.136.7.81
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.136.7.81 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.25.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.181.25.155 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.11
country_id: 1512440
description:
Nov 16 00:51:26 host2 sshd[979235]: Disconnected from invalid user szy 194.107.115.11 port 35544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.75
country_id: 3175395
description:
Nov 16 00:54:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=217.26.179.75, lip=66.85.158.91, TLS, session=<1w1aDadDcODZGrNL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.11
country_id: 1512440
description:
Nov 16 00:53:12 host2 sshd[980083]: Disconnected from invalid user vivek 194.107.115.11 port 12016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.20.66.206
country_id: 783754
description:
Nov 16 00:53:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=84.20.66.206, lip=66.85.158.91, TLS, session=<78tNDKdDo41UFELO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.11
country_id: 1512440
description:
Nov 16 00:56:25 host2 sshd[982681]: Disconnected from invalid user test 194.107.115.11 port 19336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-16 00:57:00 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:56928: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-11-16 00:57:15 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:60354: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-16 00:57:34 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:44404: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.11
country_id: 1512440
description:
Nov 16 01:02:38 host2 sshd[986097]: Disconnected from invalid user leo 194.107.115.11 port 33944 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.58.242
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.151.58.242 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.187.191.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.187.191.54 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.215.59.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.215.59.203 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.104.186.124
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.104.186.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.246.34.61
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.246.34.61 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.44.9.172
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.44.9.172 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.74.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.74.13 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 01:08:33 host2 sshd[989530]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.99.149
country_id: 3077311
description:
Nov 16 01:15:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=176.98.99.149, lip=66.85.158.91, TLS, session=<SE/8WKdD4pKwYmOV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.117.178.90
country_id: 2510769
description:
Nov 16 01:15:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.117.178.90, lip=66.85.158.91, TLS, session=<B1QWWqdDeqdbdbJa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 01:23:26 host2 sshd[998199]: Disconnected from invalid user shannon 62.60.131.157 port 15129 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 01:25:08 host2 sshd[999598]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Nov 16 01:32:33 host2 sshd[1003997]: Disconnected from invalid user beth 123.58.213.127 port 50012 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 01:34:56 host2 sshd[1005075]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.127
country_id: 1819730
description:
Nov 16 01:36:48 host2 sshd[1006272]: Disconnected from invalid user backupuser 123.58.213.127 port 47630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 01:39:31 host2 sshd[1007520]: Disconnected from invalid user shannon 62.60.131.157 port 15018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Nov 16 01:39:47 host2 sshd[1007705]: Disconnected from invalid user marek 123.58.213.127 port 35388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Nov 16 01:44:13 host2 sshd[1010169]: Disconnected from invalid user devel 123.58.213.127 port 35468 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.240.121.215
country_id: 2802361
description:
Nov 16 01:45:56 host2 pure-ftpd[1011646]: (?@35.240.121.215) [INFO] New connection from 35.240.121.215


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 01:48:10 host2 sshd[1013112]: Disconnected from invalid user  2.57.121.112 port 62182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-11-16 01:48:55 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:60244: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-11-16 01:48:19 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:45396: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.107.195
country_id: 1269750
description:
Nov 16 01:52:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.87.107.195, lip=66.85.158.91, TLS, session=<vbLp3qdDsZtnV2vD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.43
country_id: 2300660
description:
Nov 16 01:52:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=41.139.47.43, lip=66.85.158.91, TLS, session=<RWMq4KdDxN0piy8r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.198.7
country_id: 2264397
description:
Nov 16 01:59:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.198.7, lip=66.85.158.92, TLS, session=<Jx7f96dDHaO54sYH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.198.7
country_id: 2264397
description:
Nov 16 01:59:02 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.226.198.7, lip=66.85.158.92, TLS, session=<wA739qdDWbm54sYH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.198.4
country_id: 2264397
description:
Nov 16 01:59:05 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.198.4, lip=66.85.158.92, TLS, session=<2zAl96dDkIa54sYE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.198.6
country_id: 2264397
description:
Nov 16 01:59:06 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.198.6, lip=66.85.158.92, TLS, session=<0Pc296dDqaO54sYG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.198.5
country_id: 2264397
description:
Nov 16 01:59:10 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.226.198.5, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tEt296dDJ6u54sYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 02:06:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49297: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.190.31
country_id: 1819730
description:
Nov 16 02:10:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.190.31, lip=66.85.158.91, session=<kFmwHqhDLOGYIL4f>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-16 02:11:21 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:35177: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.13.91.157
country_id: 3077311
description:
Nov 16 02:13:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=85.13.91.157, lip=66.85.158.91, TLS, session=<J6jxKqhDsL5VDVud>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.120
country_id: 798544
description:
Nov 16 02:14:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=91.228.33.120, lip=66.85.158.91, TLS, session=<LCf6K6hDLt5b5CF4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 16 02:17:48 host2 sshd[1031591]: Disconnected from invalid user material 79.61.112.234 port 44270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 16 02:23:10 host2 sshd[1034646]: Disconnected from invalid user rdp 79.61.112.234 port 34340 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 16 02:24:23 host2 sshd[1035274]: Disconnected from invalid user steam 79.61.112.234 port 34514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 16 02:26:41 host2 sshd[1036984]: Disconnected from invalid user iptv 79.61.112.234 port 34854 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.209.243
country_id: 1819730
description:
Nov 16 02:30:09 host2 pure-ftpd[1039094]: (?@123.58.209.243) [INFO] New connection from 123.58.209.243


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Nov 16 02:33:11 host2 sshd[1040912]: Disconnected from invalid user opsadmin 20.123.120.169 port 34786 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.75
country_id: 831053
description:
[2025-11-16 02:35:25 +0530] info [cpaneld] 37.35.67.75 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.120.169
country_id: 2963597
description:
Nov 16 02:35:44 host2 sshd[1042485]: Disconnected from invalid user rancid 20.123.120.169 port 50252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Nov 16 02:38:29 host2 sshd[1044258]: Disconnected from invalid user gautam 20.123.120.169 port 58558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-11-16 02:38:39 dovecot_plain authenticator failed for (molie) [46.10.210.68]:43112: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-16 02:40:50 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-11-16 02:43:00 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (fretted) [68.38.201.238]:33954: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.251.104
country_id: 298795
description:
2025-11-16 02:43:02 dovecot_plain authenticator failed for (procculams) [5.11.251.104]:58839: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-11-16 02:51:05 dovecot_plain authenticator failed for ool-457e901e.dyn.optonline.net (pated) [69.126.144.30]:59613: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.95.200.219
country_id: 798544
description:
Nov 16 02:55:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=109.95.200.219, lip=66.85.158.91, TLS, session=<MSKEv6hDLMttX8jb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 02:56:06 host2 sshd[1055923]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.171.78.39
country_id: 3686110
description:
Nov 16 02:55:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=190.171.78.39, lip=66.85.158.91, TLS, session=<QAOqwKhDuca+q04n>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 03:01:50 host2 sshd[1059716]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 03:04:47 host2 sshd[1062071]: Disconnected from invalid user admin 2.57.121.112 port 44519 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 03:11:35 host2 sshd[1067082]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.90.56.89
country_id: 6252001
description:
2025-11-16 03:18:46 dovecot_login authenticator failed for h89.56.90.75.dynamic.ip.windstream.net [75.90.56.89]:33036: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-16 03:19:08 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (sitic) [73.176.157.57]:47468: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-11-16 03:19:41 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:34288: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.231.89.218
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 103.231.89.218 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.145
country_id: 2661886
description:
2025-11-16 03:26:23 dovecot_login authenticator failed for 95.209.141.145.bredband.tre.se [95.209.141.145]:42918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-16 03:26:38 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:38001: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 03:31:23 host2 sshd[1080534]: Disconnected from invalid user deasia 62.60.131.157 port 13206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:34:41 host2 sshd[1082386]: Disconnected from invalid user dev 202.165.22.246 port 45884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.81.18.103
country_id: 2921044
description:
Nov 16 03:35:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=206.81.18.103, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<44VvUalDfZ7OURJn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.238.49
country_id: 2921044
description:
Nov 16 03:36:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.90.238.49, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kKKJU6lDqDOkWu4x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.12
country_id: 690791
description:
Nov 16 03:37:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.221.131.12, lip=66.85.158.91, TLS, session=<hOVVVKlD3YQl3YMM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.37.25
country_id: 3469034
description:
Nov 16 03:37:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<jagath.peiris>, method=PLAIN, rip=167.249.37.25, lip=66.85.158.91, TLS, session=<RwgkVqlDbNen+SUZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:41:24 host2 sshd[1086851]: Disconnected from invalid user admin 202.165.22.246 port 33266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:42:46 host2 sshd[1087504]: Disconnected from invalid user username 202.165.22.246 port 34452 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.177
country_id: 6252001
description:
Nov 16 03:43:22 host2 pure-ftpd[1087849]: (?@147.185.132.177) [INFO] New connection from 147.185.132.177


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.5
country_id: 3175395
description:
Nov 16 03:43:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=217.26.179.5, lip=66.85.158.91, TLS, session=<bYhMbKlDdZ3ZGrMF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.79
country_id: 3469034
description:
Nov 16 03:44:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=177.44.71.79, lip=66.85.158.91, TLS, session=<Qd52balDLtSxLEdP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:44:06 host2 sshd[1088260]: Disconnected from invalid user kn 202.165.22.246 port 35636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:45:28 host2 sshd[1089797]: Disconnected from invalid user user1 202.165.22.246 port 36822 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.25.213
country_id: 2921044
description:
Nov 16 03:49:50 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.22.25.213, lip=66.85.158.92, TLS, session=<ZI0/g6lD5BKlFhnV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-11-16 03:55:31 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (threcia) [2.135.31.74]:51786: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.83
country_id: 6252001
description:
Nov 16 03:57:44 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.83, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hZR1n6lDotLN0h9T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-11-16 04:00:03 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:35141: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.29.40
country_id: 290557
description:
2025-11-16 04:00:25 dovecot_login authenticator failed for ([91.74.29.40]) [91.74.29.40]:51110: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-11-16 04:00:35 dovecot_plain authenticator failed for (bruen) [94.206.93.90]:34212: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 16 04:05:08 host2 sshd[1105835]: Disconnected from invalid user share 128.1.132.137 port 53314 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 16 04:05:11 host2 pure-ftpd[1105894]: (?@45.227.254.156) [INFO] New connection from 45.227.254.156


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:07:34 host2 sshd[1108070]: Disconnected from invalid user a 159.223.8.81 port 45246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 16 04:10:31 host2 sshd[1110825]: Disconnected from invalid user vpn 128.1.132.137 port 56994 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.201.204
country_id: 6251999
description:
Nov 16 04:10:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=128.203.201.204, lip=66.85.158.92, session=<XNMnzqlDgImAy8nM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:10:49 host2 sshd[1111073]: Disconnected from invalid user diego 159.223.8.81 port 48312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 16 04:11:44 host2 sshd[1112146]: Disconnected from invalid user admin 128.1.132.137 port 50612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:15:07 host2 sshd[1115878]: Disconnected from invalid user vipin 159.223.8.81 port 40858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:18:14 host2 sshd[1119372]: Disconnected from invalid user share 159.223.8.81 port 35842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.58
country_id: 6252001
description:
Nov 16 04:20:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.58, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eCJQ76lDpNfG6xg6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:19:18 host2 sshd[1120464]: Disconnected from invalid user andrey 159.223.8.81 port 49088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2025-11-16 04:20:37 dovecot_login authenticator failed for ([49.124.153.15]) [49.124.153.15]:53230: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.240.184
country_id: 6252001
description:
Nov 16 04:27:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.12.240.184, lip=66.85.158.91, session=<PYtpCqpDgqsUDPC4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.84
country_id: 6252001
description:
Nov 16 04:28:42 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.84, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<D/I2DqpDJoOH7X5U>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:32:19 host2 sshd[1135527]: Disconnected from invalid user singh 152.32.218.244 port 47406 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.200.53
country_id: 2921044
description:
Nov 16 04:33:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.200.53, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<HaabH6pDF9OkXMg1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.69.80.240
country_id: 3175395
description:
Nov 16 04:33:43 host2 sshd[1137294]: Disconnected from invalid user singh 151.69.80.240 port 55462 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.184.19
country_id: 2921044
description:
Nov 16 04:34:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.90.184.19, lip=66.85.158.92, TLS handshaking: Connection closed, session=<lpm2IapDbiGkWrgT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.248
country_id: 6252001
description:
Nov 16 04:35:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.174.248, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ssjfJKpDluIofK74>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.57
country_id: 3469034
description:
Nov 16 04:36:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.44.71.57, lip=66.85.158.91, TLS, session=<C9RJKqpD48KxLEc5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.69.80.240
country_id: 3175395
description:
Nov 16 04:37:46 host2 sshd[1139666]: Disconnected from invalid user nodejs 151.69.80.240 port 54094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.65.4
country_id: 1269750
description:
Nov 16 04:37:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=103.58.65.4, lip=66.85.158.91, TLS, session=<AEGPK6pDop5nOkEE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:37:38 host2 sshd[1139608]: Disconnected from invalid user k8s 152.32.218.244 port 45780 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 04:38:22 host2 sshd[1140001]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:40:16 host2 sshd[1141074]: Disconnected from invalid user dev 152.32.218.244 port 44460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.69.80.240
country_id: 3175395
description:
Nov 16 04:40:33 host2 sshd[1141312]: Disconnected from invalid user user 151.69.80.240 port 38804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:42:44 host2 sshd[1142574]: Disconnected from invalid user rmartinez 152.32.218.244 port 43150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:44:04 host2 sshd[1143348]: Disconnected from invalid user tester 104.168.101.178 port 52532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:45:33 host2 sshd[1144973]: Disconnected from invalid user fns 104.168.101.178 port 56448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:46:57 host2 sshd[1145748]: Disconnected from invalid user cma 104.168.101.178 port 53120 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 04:48:08 host2 sshd[1146364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 04:58:13 host2 sshd[1152424]: Disconnected from invalid user hadoop 147.182.173.108 port 45400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.22
country_id: 3175395
description:
Nov 16 04:59:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=217.26.178.22, lip=66.85.158.91, TLS, session=<OfQ6e6pDX+TZGrIW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.122
country_id: 953987
description:
Nov 16 04:59:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.129.51.122, lip=66.85.158.91, TLS, session=<xE6IfKpD/uFmgTN6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:02:48 host2 sshd[1155855]: Disconnected from invalid user pool 147.182.173.108 port 52090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:03:55 host2 sshd[1156990]: Disconnected from invalid user psn 147.182.173.108 port 36670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:07:11 host2 sshd[1159228]: Disconnected from invalid user ubuntu 147.182.173.108 port 44496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.82
country_id: 3469034
description:
Nov 16 05:08:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.130.170.82, lip=66.85.158.91, TLS, session=<KdF1mqpDeuOxgqpS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:08:16 host2 sshd[1159964]: Disconnected from invalid user botuser 147.182.173.108 port 44646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.205.89
country_id: 3175395
description:
Nov 16 05:08:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=109.70.205.89, lip=66.85.158.91, TLS, session=<kvCmm6pDCZ9tRs1Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-16 05:11:36 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (storoed) [81.226.88.121]:47256: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:12:30 host2 sshd[1162526]: Disconnected from invalid user pool 45.78.198.115 port 44470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:15:11 host2 sshd[1164068]: Disconnected from invalid user botuser 45.78.198.115 port 47708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-11-16 05:16:10 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:39155: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.143
country_id: 732800
description:
Nov 16 05:16:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.255.212.143, lip=66.85.158.91, TLS, session=<1WmluKpDR+G5/9SP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.173
country_id: 3175395
description:
Nov 16 05:16:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=185.197.9.173, lip=66.85.158.91, TLS, session=<deW/uapDBb+5xQmt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-16 05:16:24 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:43765: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:20:23 host2 sshd[1167164]: Disconnected from invalid user gmodserver 45.78.198.115 port 47210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-16 05:23:25 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (kagial) [73.195.211.98]:47856: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 05:30:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:46918: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:30:55 host2 sshd[1173667]: Disconnected from invalid user ubuntu 45.78.198.115 port 57298 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 05:34:05 host2 sshd[1175572]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.148
country_id: 1269750
description:
Nov 16 05:37:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.51.223.148, lip=66.85.158.91, TLS, session=<E4DAAqtDeM9nM9+U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.223
country_id: 3865483
description:
Nov 16 05:37:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=190.181.97.223, lip=66.85.158.91, TLS, session=<cJr9A6tDer2+tWHf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-11-16 05:41:13 +0530] info [cpaneld] 38.35.225.197 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-11-16 05:41:47 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:45292: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-16 05:42:05 dovecot_login authenticator failed for ([125.19.175.128]) [27.123.112.90]:35596: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-11-16 05:42:20 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:45848: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Nov 16 05:46:28 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, session=<4cJdJKtDkPqs7ORz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 05:48:13 host2 sshd[1184318]: Disconnected from invalid user trisha 62.60.131.157 port 48593 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 05:48:20 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56177: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.250.168
country_id: 2921044
description:
Nov 16 05:51:34 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.248.250.168, lip=66.85.158.92, TLS, session=<Q1uVNqtDUKxo+Pqo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.199
country_id: 3469034
description:
Nov 16 06:00:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<training@v-deploy.com>, method=PLAIN, rip=177.44.96.199, lip=66.85.158.91, TLS, session=<4tvSVatD79GxLGDH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.51
country_id: 953987
description:
Nov 16 06:01:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training>, method=PLAIN, rip=102.129.54.51, lip=66.85.158.91, TLS, session=<jMWHV6tDn4hmgTYz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 06:01:19 host2 sshd[1192448]: Disconnected from invalid user trisha 62.60.131.157 port 7664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2025-11-16 06:11:56 dovecot_login authenticator failed for (179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:43281: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.46
country_id: 3175395
description:
Nov 16 06:13:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.197.9.46, lip=66.85.158.91, TLS, session=<UpH7hKtDH9m5xQku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.110
country_id: 3175395
description:
Nov 16 06:14:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=217.26.179.110, lip=66.85.158.91, TLS, session=<7OsahqtDOsbZGrNu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 06:14:59 host2 sshd[1201992]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:16:39 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:37159: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.189
country_id: 6252001
description:
Nov 16 06:19:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<pToFm6tDl8eTuYS9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:21:52 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:13224: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 06:24:46 host2 sshd[1207713]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:26:37 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:21096: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2025-11-16 06:30:50 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:59090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:31:42 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:45311: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-16 06:31:52 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:60558: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-16 06:31:37 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:45181: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.75
country_id: 953987
description:
Nov 16 06:34:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.33.75, lip=66.85.158.91, TLS, session=<8LqIz6tDdopmQCFL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.126
country_id: 798544
description:
Nov 16 06:34:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.246.213.126, lip=66.85.158.91, TLS, session=<xf/D0KtDHdpb9tV+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:36:47 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:47283: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 06:40:44 host2 sshd[1218636]: Disconnected from invalid user user 2.57.121.25 port 28803 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:42:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<D0Z57KtDfJUDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:42:26 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<Io9+7KtDipUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:45:13 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<WKt59qtDtuADiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:45:22 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<gbQC96tDZI0DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-16 06:46:23 dovecot_plain authenticator failed for (somatonsit) [102.53.15.17]:35734: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:47:11 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<2Fd6/atDCqkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:49:22 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<QUdRBaxDAKwDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 06:50:19 host2 sshd[1225617]: Disconnected from invalid user user 2.57.121.25 port 32625 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:51:15 host2 sshd[1226169]: Disconnected from invalid user admin 2.57.121.112 port 62195 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-16 06:51:31 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:35167: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-16 06:51:56 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:43515: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:56:24 host2 sshd[1230470]: Disconnected from invalid user admin 2.57.121.112 port 58890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:57:12 host2 sshd[1230986]: Disconnected from invalid user admin 2.57.121.112 port 62047 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:02:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<MXsuNKxDhq4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:04:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ktl9PKxDXJIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:06:26 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<exJZQqxDtKgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:07:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<uWYRRqxDFs4DgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:07:46 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<rYUXR6xD9oEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:09:24 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0gTtTKxDyIUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.3
country_id: 1269750
description:
Nov 16 07:12:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.51.223.3, lip=66.85.158.91, TLS, session=<n+ukVqxDUpBnM98D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.52.52
country_id: 3469034
description:
Nov 16 07:12:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=170.82.52.52, lip=66.85.158.91, TLS, session=<KC3tV6xDPtmqUjQ0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.184.226.126
country_id: 3865483
description:
Nov 16 07:13:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.184.226.126, lip=66.85.158.91, TLS, session=<eoDdWKxD4uS+uOJ+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.40
country_id: 1269750
description:
Nov 16 07:13:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=45.118.34.40, lip=66.85.158.91, TLS, session=<SUghWqxDTIEtdiIo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:15:58 host2 sshd[1242468]: Disconnected from invalid user ventas05 83.168.78.153 port 40250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.151
country_id: 3865483
description:
Nov 16 07:16:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.181.101.151, lip=66.85.158.91, TLS, session=<RNNkY6xDppq+tWWX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.85
country_id: 2510769
description:
Nov 16 07:16:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.214.138.85, lip=66.85.158.91, TLS, session=<CWiVZKxDF8251opV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:19:50 host2 sshd[1244621]: Disconnected from invalid user joshua 83.168.78.153 port 44754 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:21:03 host2 sshd[1245466]: Disconnected from invalid user lee 83.168.78.153 port 44268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:23:30 host2 sshd[1246843]: Disconnected from invalid user admin 83.168.78.153 port 54360 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 16 07:23:31 host2 pure-ftpd[1246874]: (?@66.132.153.127) [INFO] New connection from 66.132.153.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:26:14 host2 sshd[1248549]: Disconnected from invalid user rolando 150.230.211.198 port 35150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.103
country_id: 6252001
description:
Nov 16 07:31:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.103, lip=66.85.158.91, TLS, session=<UWVQnaxDYu7N0h9n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-16 07:36:10 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:40254: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-16 07:36:24 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:39607: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:42:34 host2 sshd[1256276]: Disconnected from invalid user no-reply 150.230.211.198 port 40928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:43:56 host2 sshd[1257008]: Disconnected from invalid user action 196.188.120.232 port 58896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Nov 16 07:44:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fQe6y6xDz8uTuYRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 07:44:57 host2 sshd[1258055]: Disconnected from invalid user newuser 41.33.225.154 port 10055 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.34
country_id: 6251999
description:
Nov 16 07:44:25 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.34, lip=66.85.158.92, session=<JFEoyqxDqspWNh8i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:46:35 host2 sshd[1259051]: Disconnected from invalid user marina 150.230.211.198 port 50598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:46:48 host2 sshd[1259155]: Disconnected from invalid user rstudio 196.188.120.232 port 33290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:48:38 host2 sshd[1260069]: Disconnected from invalid user sysadmin 150.230.211.198 port 51788 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 07:51:58 host2 sshd[1262065]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:52:04 host2 sshd[1262137]: Disconnected from invalid user terraria 196.188.120.232 port 53008 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov 16 07:51:53 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<Hgzf5KxDNsA2rEyT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 16 07:53:50 host2 pure-ftpd[1263050]: (?@66.132.153.127) [INFO] New connection from 66.132.153.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 07:59:36 host2 sshd[1267281]: Disconnected from invalid user sanjay 41.33.225.154 port 39529 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 08:01:47 host2 sshd[1268667]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 08:04:59 host2 sshd[1271267]: Disconnected from invalid user snq 41.33.225.154 port 9605 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 08:08:37 host2 sshd[1273842]: Disconnected from invalid user pierre 41.33.225.154 port 33328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-16 08:10:05 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:46626: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-11-16 08:09:16 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:33264: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.195
country_id: 3175395
description:
Nov 16 08:16:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=171.22.235.195, lip=66.85.158.91, TLS, session=<73UuOq1DA+KrFuvD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.216.251
country_id: 99237
description:
Nov 16 08:16:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=65.20.216.251, lip=66.85.158.91, TLS, session=<vo1MO61Du+RBFNj7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.233.177.188
country_id: 6252001
description:
2025-11-16 08:19:42 dovecot_login authenticator failed for (188.177.233.68.naturalwireless.com) [68.233.177.188]:59140: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-11-16 08:20:06 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:63804: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.234
country_id: 1880251
description:
Nov 16 08:25:08 host2 sshd[1284796]: Disconnected from invalid user bitcoin 45.78.206.234 port 40582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-16 08:26:39 dovecot_plain authenticator failed for (legratobs) [2.55.122.202]:60416: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.204.217.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 151.204.217.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.49
country_id: 6252001
description:
Nov 16 08:30:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.49, lip=66.85.158.92, TLS, session=<mP28b61DYPDG6xgx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 08:32:55 host2 sshd[1288990]: Disconnected from invalid user  2.57.121.112 port 61478 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.222.160.62
country_id: 1880251
description:
Nov 16 08:33:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=8.222.160.62, lip=66.85.158.91, session=<MlRbeK1DhFMI3qA+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:33:44 host2 sshd[1289385]: Disconnected from invalid user git 89.97.218.142 port 49454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:34:50 host2 sshd[1289879]: Disconnected from invalid user victor 89.97.218.142 port 49476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:36:53 host2 sshd[1291301]: Disconnected from invalid user piyush 89.97.218.142 port 49508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:38:45 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gw9zjK1Dn8qi2JYK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:39:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<TJ7Cj61DJOui2JYK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.108
country_id: 6252001
description:
Nov 16 08:41:43 host2 pure-ftpd[1294023]: (?@64.62.156.108) [INFO] New connection from 64.62.156.108


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:43:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS, session=<2NuLnq1DVOyi2JYK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 16 08:56:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<m/BbzK1Dts42xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Nov 16 08:57:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.165, lip=66.85.158.91, TLS, session=<gQR2z61DHPLG6xil>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.12
country_id: 6252001
description:
Nov 16 08:57:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.12, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Roe60K1DlNWTuYQM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-16 08:58:25 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:58305: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.234
country_id: 1880251
description:
Nov 16 08:58:29 host2 sshd[1304381]: Disconnected from invalid user git 45.78.206.234 port 44522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 16 09:00:43 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.92, session=<FRgJ261D/Mc2xDDo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.194
country_id: 6252001
description:
Nov 16 09:02:34 host2 pure-ftpd[1306472]: (?@198.235.24.194) [INFO] New connection from 198.235.24.194


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 16 09:09:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<gOZg+a1D6IwD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-16 09:09:19 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:53416: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-16 09:09:26 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:47496: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 16 09:11:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<w+IaA65DlJczn+p2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-16 09:11:34 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:61578: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 16 09:11:55 host2 pure-ftpd[1312057]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.20
country_id: 798544
description:
Nov 16 09:15:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=91.228.32.20, lip=66.85.158.91, TLS, session=<9KvxDa5DbOFb5CAU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.54
country_id: 798544
description:
Nov 16 09:15:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=178.216.29.54, lip=66.85.158.91, TLS, session=<CYn5Dq5Dt8qy2B02>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a01:239:213:1900::1
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2a01:239:213:1900::1 - yashiholdingscom "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.247.137
country_id: 933860
description:
Nov 16 09:23:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=41.76.247.137, lip=66.85.158.91, TLS, session=<0MClKa5DOdspTPeJ>


