# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-13 22:08:44 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:44953: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-13 22:07:51 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:54284: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.124.195
country_id: 337996
description:
Nov 13 22:09:25 host2 sshd[3067823]: Disconnected from invalid user vladimir 196.189.124.195 port 40116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.222
country_id: 3469034
description:
Nov 13 22:11:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=179.189.199.222, lip=66.85.158.91, TLS, session=<xhqcjHxDnKazvcfe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.167
country_id: 798544
description:
Nov 13 22:11:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=128.127.94.167, lip=66.85.158.91, TLS, session=<ru92i3xDjNeAf16n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.97.88
country_id: 2635167
description:
Nov 13 22:14:31 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=101.36.97.88, lip=66.85.158.92, session=<5YhgmHxDAp5lJGFY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 101.36.97.88
country_id: 2635167
description:
Nov 13 22:14:32 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=101.36.97.88, lip=66.85.158.92, TLS, session=<CFZrmHxD3J5lJGFY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-13 22:14:32 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:45180: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 22:15:27 host2 sshd[3073990]: Disconnected from invalid user admin 2.57.121.112 port 31891 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 22:16:58 host2 sshd[3075534]: Disconnected from invalid user user 2.57.121.25 port 15518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-13 22:17:39 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:37126: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 22:17:50 host2 sshd[3076410]: Disconnected from invalid user patience 62.60.131.157 port 11620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-13 22:18:09 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:49528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-11-13 22:24:58 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (cordervist) [76.157.219.158]:39452: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.34
country_id: 3996063
description:
2025-11-13 22:36:12 dovecot_login authenticator failed for ([201.173.97.34]) [201.173.97.34]:55614: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.217
country_id: 6251999
description:
2025-11-13 22:36:29 dovecot_login authenticator failed for (ADMIN) [84.247.105.217]:35494: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.67.18
country_id: 1643084
description:
2025-11-13 22:36:45 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.18]:56694: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Nov 13 22:39:08 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<+zhn8HxDkEtBMRRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.191
country_id: 3469034
description:
Nov 13 22:41:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.249.191, lip=66.85.158.91, TLS, session=<HhSA+HxDELq60fm/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.210.91
country_id: 798544
description:
Nov 13 22:42:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=91.246.210.91, lip=66.85.158.91, TLS, session=<qu6m+XxDWZtb9tJb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.56
country_id: 1269750
description:
Nov 13 22:45:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.104.127.56, lip=66.85.158.91, TLS, session=<FsmFBX1DvaZnaH84>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.76.184.8
country_id: 732800
description:
Nov 13 22:45:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=77.76.184.8, lip=66.85.158.91, TLS, session=<LoCpBn1Dic5NTLgI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 22:58:07 host2 sshd[3114986]: Disconnected from invalid user admin 2.57.121.112 port 58863 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.97.37
country_id: 2921044
description:
2025-11-13 22:58:40 dovecot_login authenticator failed for (ADMIN) [45.88.97.37]:50000: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.119.19.172
country_id: 2510769
description:
2025-11-13 22:59:00 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:33420: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.91.154
country_id: 3469034
description:
2025-11-13 22:59:26 dovecot_login authenticator failed for ([186.227.91.154]) [186.227.91.154]:49667: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-11-13 23:00:05 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:36825: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov 13 23:06:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rLdqUn1D/By4aff+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.75
country_id: 6252001
description:
Nov 13 23:06:39 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.75, lip=66.85.158.92, session=<KJ7HUn1DwaBBMQFL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Nov 13 23:06:50 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.66, lip=66.85.158.92, TLS: Connection closed, session=<zT11U31DlrlBMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.38
country_id: 6252001
description:
Nov 13 23:06:51 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Gm+AU31D2bVBMQEm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov 13 23:06:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zMGrU31D7Ou4aff+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.118.133
country_id: 6252001
description:
Nov 13 23:07:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.56.118.133, lip=66.85.158.92, session=<Vu4gVX1DENYtOHaF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.118.133
country_id: 6252001
description:
Nov 13 23:08:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.56.118.133, lip=66.85.158.92, session=<acHIV31DRhYtOHaF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.67
country_id: 6252001
description:
Nov 13 23:09:15 host2 pure-ftpd[3121674]: (?@198.235.24.67) [INFO] New connection from 198.235.24.67


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.247
country_id: 6252001
description:
Nov 13 23:11:11 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.247, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7f8EY31DmMmi2JX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.118.133
country_id: 6252001
description:
Nov 13 23:11:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 1 secs): user=<>, rip=45.56.118.133, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<aY6dZX1DOqYtOHaF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 13 23:12:08 host2 pure-ftpd[3123518]: (?@64.62.156.192) [INFO] New connection from 64.62.156.192


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.247
country_id: 6252001
description:
Nov 13 23:12:12 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=162.216.149.247, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<w++gZn1D5OKi2JX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.247
country_id: 6252001
description:
Nov 13 23:16:22 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.247, lip=66.85.158.92, TLS, session=<i+iMdX1DLPyi2JX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.6
country_id: 614540
description:
2025-11-13 23:17:33 dovecot_login authenticator failed for (ADMIN) [95.181.236.6]:25162: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 23:21:17 host2 sshd[3128296]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.101.153
country_id: 3175395
description:
Nov 13 23:25:56 host2 sshd[3130810]: Disconnected from invalid user fabien 151.47.101.153 port 34714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-13 23:28:07 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:59678: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.101.153
country_id: 3175395
description:
Nov 13 23:29:25 host2 sshd[3132611]: Disconnected from invalid user erp 151.47.101.153 port 34584 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 13 23:30:11 host2 sshd[3133097]: Disconnected from invalid user gt 197.5.145.73 port 50859 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 23:31:23 host2 sshd[3133799]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.101.153
country_id: 3175395
description:
Nov 13 23:32:03 host2 sshd[3134084]: Disconnected from invalid user odoo2 151.47.101.153 port 34606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.101.153
country_id: 3175395
description:
Nov 13 23:33:20 host2 sshd[3134618]: Disconnected from invalid user vera 151.47.101.153 port 34853 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.225.224
country_id: 3017382
description:
2025-11-13 23:39:31 dovecot_login authenticator failed for 82-64-225-224.subs.proxad.net [82.64.225.224]:58507: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-13 23:39:44 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:45650: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.102
country_id: 2921044
description:
2025-11-13 23:41:45 dovecot_login authenticator failed for (ADMIN) [191.101.157.102]:1962: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.17.133.138
country_id: 3469034
description:
Nov 13 23:42:17 host2 sshd[3139851]: Disconnected from invalid user vera 201.17.133.138 port 44794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.21.117
country_id: 798544
description:
Nov 13 23:44:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=89.186.21.117, lip=66.85.158.91, TLS, session=</3CK2X1DuOFZuhV1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.19.42
country_id: 3175395
description:
Nov 13 23:44:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=185.43.19.42, lip=66.85.158.91, TLS, session=<XLCi2n1Dl8q5KxMq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2025-11-13 23:46:25 dovecot_plain authenticator failed for 68.129.5.84.rev.sfr.net (rueurara) [84.5.129.68]:49790: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 23:49:42 host2 sshd[3144582]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.155.216.248
country_id: 3469034
description:
2025-11-13 23:58:27 dovecot_login authenticator failed for (gbonline.com.br) [177.155.216.248]:58013: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-11-13 23:58:58 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:51688: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-13 23:59:32 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:43390: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Nov 14 00:00:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.91, session=<Q8wEEn5DjOBKUi8E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.105
country_id: 3144096
description:
2025-11-14 00:02:48 dovecot_login authenticator failed for (ADMIN) [46.246.122.105]:24973: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.54
country_id: 2300660
description:
Nov 14 00:03:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=41.139.28.54, lip=66.85.158.91, TLS, session=<lZNiHn5DSrQpixw2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.100.157
country_id: 3865483
description:
Nov 14 00:04:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=190.181.100.157, lip=66.85.158.91, TLS, session=<AprzH35D5MK+tWSd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov 14 00:05:05 host2 sshd[3154303]: Disconnected from invalid user term1 103.174.115.196 port 39234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 00:08:19 host2 sshd[3155890]: Disconnected from invalid user pritchard 2.57.121.112 port 61382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.11
country_id: 798544
description:
Nov 14 00:08:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=91.236.172.11, lip=66.85.158.91, TLS, session=<+bB6Ln5Duc1b7KwL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.160.174.228
country_id: 798544
description:
Nov 14 00:08:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=82.160.174.228, lip=66.85.158.91, TLS, session=<qPBmLX5Dy7hSoK7k>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov 14 00:08:53 host2 sshd[3156147]: Disconnected from invalid user in 103.174.115.196 port 44652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.115.196
country_id: 1643084
description:
Nov 14 00:16:10 host2 sshd[3160862]: Disconnected from invalid user debian 103.174.115.196 port 46106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.28
country_id: 6252001
description:
2025-11-14 00:17:34 dovecot_login authenticator failed for ([70.174.168.28]) [70.174.168.28]:49051: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-11-14 00:17:53 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:45256: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 00:18:33 host2 sshd[3162560]: Disconnected from invalid user admin 2.57.121.112 port 35247 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-11-14 00:20:04 dovecot_login authenticator failed for ([113.11.34.221]) [113.11.34.221]:44488: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-11-14 00:20:22 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:57149: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov 14 00:21:41 host2 sshd[3164355]: Disconnected from invalid user mohamad 103.174.115.196 port 48118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.198
country_id: 2635167
description:
2025-11-14 00:22:42 dovecot_login authenticator failed for (ADMIN) [45.133.172.198]:49676: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 00:28:32 host2 sshd[3167809]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 00:29:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49770: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:32:08 host2 sshd[3170312]: Disconnected from invalid user sharan 205.185.115.224 port 42756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.206
country_id: 2300660
description:
Nov 14 00:32:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.139.10.206, lip=66.85.158.91, TLS, session=</QSkg35DE4EpiwrO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.236.2
country_id: 798544
description:
Nov 14 00:32:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=109.125.236.2, lip=66.85.158.91, TLS, session=<1NLkhH5DBeZtfewC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.46
country_id: 690791
description:
Nov 14 00:33:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.17.125.46, lip=66.85.158.91, TLS, session=<9mGHiX5DQcO5EX0u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.78
country_id: 798544
description:
Nov 14 00:34:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=109.125.244.78, lip=66.85.158.91, TLS, session=<cQeiin5DOqNtffRO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:35:32 host2 sshd[3172132]: Disconnected from invalid user web 205.185.115.224 port 48176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:36:42 host2 sshd[3172644]: Disconnected from invalid user vss 205.185.115.224 port 46284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:37:50 host2 sshd[3173170]: Disconnected from invalid user rocky 205.185.115.224 port 44396 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 00:38:36 host2 sshd[3173615]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:40:06 host2 sshd[3174570]: Disconnected from invalid user lam 205.185.115.224 port 40626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-14 00:43:33 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (teracheal) [73.195.211.98]:39374: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.120
country_id: 6252001
description:
2025-11-14 00:44:19 dovecot_login authenticator failed for (ADMIN) [102.129.252.120]:52272: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Nov 14 00:49:15 host2 sshd[3180919]: Disconnected from invalid user yxu 181.49.50.6 port 52044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Nov 14 00:51:46 host2 sshd[3182591]: Disconnected from invalid user jiaxuan 181.49.50.6 port 51348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Nov 14 00:53:06 host2 sshd[3183316]: Disconnected from invalid user celka 181.49.50.6 port 50996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov 14 01:04:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<ohWm9n5DcItChJmE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.174
country_id: 6252001
description:
2025-11-14 01:07:14 dovecot_login authenticator failed for (ADMIN) [212.56.54.174]:63571: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.167
country_id: 6252001
description:
Nov 14 01:09:19 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.167, lip=66.85.158.91, TLS handshaking: Connection closed, session=</jB/CX9DTdzDuEyn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.205
country_id: 6252001
description:
Nov 14 01:09:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.205, lip=66.85.158.91, TLS: Connection closed, session=<56ccCn9DgePDuEzN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.160
country_id: 6252001
description:
Nov 14 01:09:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.160, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<h9OQCn9D/Y3DuEyg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.228
country_id: 6252001
description:
Nov 14 01:09:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.228, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gQLRCn9D/tXN0h/k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.161
country_id: 6252001
description:
Nov 14 01:09:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.161, lip=66.85.158.91, TLS: Connection closed, session=<pJe/Cn9Dba7DuEyh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 01:15:01 host2 sshd[3196704]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.2.189.222
country_id: 798544
description:
Nov 14 01:17:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=83.2.189.222, lip=66.85.158.91, TLS, session=<XnwtJn9D3uZTAr3e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.41
country_id: 1733045
description:
2025-11-14 01:17:44 dovecot_login authenticator failed for ([49.124.146.41]) [49.124.146.41]:42096: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-11-14 01:18:26 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:49949: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-11-14 01:18:49 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:59614: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.35.68
country_id: 2395170
description:
Nov 14 01:17:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=154.127.35.68, lip=66.85.158.91, TLS, session=<gBVTJ39DGZ+afyNE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-11-14 01:18:04 dovecot_login authenticator failed for ([125.17.70.25]) [125.20.251.70]:40942: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.104.144.93
country_id: 798549
description:
2025-11-14 01:23:35 dovecot_plain authenticator failed for (mater) [86.104.144.93]:35444: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.19.0
country_id: 6251999
description:
Nov 14 01:26:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.203.19.0, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</nHWR39DqMefyxMA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.21.189
country_id: 2750405
description:
2025-11-14 01:27:15 dovecot_login authenticator failed for (ADMIN) [158.173.21.189]:55370: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.226
country_id: 3469034
description:
Nov 14 01:33:14 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=191.53.107.226, lip=66.85.158.91, TLS, session=<SfL1XX9D+LO/NWvi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.163
country_id: 798544
description:
Nov 14 01:32:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=178.219.105.163, lip=66.85.158.91, TLS, session=<uEfXXH9DlKqy22mj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 01:38:26 host2 sshd[3210661]: Disconnected from invalid user admin 2.57.121.112 port 56575 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.209
country_id: 3175395
description:
Nov 14 01:47:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=171.22.233.209, lip=66.85.158.91, TLS, session=<4Y6akX9DZc6rFunR>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.128.12
country_id: 6252001
description:
Nov 14 01:47:49 host2 pure-ftpd[3216786]: (?@172.105.128.12) [INFO] New connection from 172.105.128.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.107
country_id: 3469034
description:
Nov 14 01:47:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=186.209.250.107, lip=66.85.158.91, TLS, session=<Heq6kn9D1am60fpr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.20
country_id: 718075
description:
2025-11-14 01:49:53 dovecot_login authenticator failed for (ADMIN) [185.225.31.20]:12656: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 01:50:58 host2 sshd[3218971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-11-14 01:52:17 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:39866: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2025-11-14 01:52:20 dovecot_login authenticator failed for 216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:33046: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-14 01:52:35 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:60125: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.16.144.166
country_id: 1522867
description:
2025-11-14 01:52:42 dovecot_login authenticator failed for ([46.16.144.166]) [46.16.144.166]:42262: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Nov 14 01:52:43 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<ZgG4pH9D2tusaYAL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.172.21
country_id: 6252001
description:
Nov 14 01:53:05 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.79.172.21, lip=66.85.158.91, session=<c78Apn9DQrotT6wV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov 14 01:53:56 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.91, session=<dCwSqX9DjowtT4DN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.208
country_id: 6252001
description:
Nov 14 01:59:22 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.208, lip=66.85.158.91, session=<Ywh7vH9DqOGs7OTQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-14 01:59:52 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:46724: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-11-14 02:00:21 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:60413: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.79.207.129
country_id: 6252001
description:
Nov 14 02:05:20 host2 pure-ftpd[3228209]: (?@45.79.207.129) [INFO] New connection from 45.79.207.129


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Nov 14 02:07:16 host2 sshd[3229118]: Disconnected from invalid user es 105.27.148.94 port 57546 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.79.51
country_id: 6252001
description:
Nov 14 02:08:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=47.251.79.51, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<tVNX239DQl8v+08z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.44
country_id: 798549
description:
2025-11-14 02:08:04 dovecot_login authenticator failed for (ADMIN) [143.244.52.44]:31075: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.12
country_id: 798544
description:
Nov 14 02:08:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.125.4.12, lip=66.85.158.91, TLS, session=<za/+239DGei5fQQM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.184
country_id: 798544
description:
Nov 14 02:08:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.238.166.184, lip=66.85.158.91, TLS, session=<DrgQ3X9Dc7Fb7qa4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 02:12:19 host2 sshd[3231968]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Nov 14 02:13:20 host2 sshd[3232508]: Disconnected from invalid user gerencia 105.27.148.94 port 44722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 02:14:13 host2 sshd[3233474]: Disconnected from invalid user guest 2.57.121.112 port 61566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 02:16:13 host2 sshd[3234668]: Disconnected from invalid user admin 2.57.121.112 port 13832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.131.104.176
country_id: 6252001
description:
Nov 14 02:19:27 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=104.131.104.176, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<b4tIBIBDwIdog2iw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 14 02:20:09 host2 sshd[3236900]: Disconnected from invalid user web 92.185.99.40 port 58944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:21:10 host2 sshd[3237387]: Disconnected from invalid user ftpuser 143.110.137.94 port 36358 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 02:22:00 host2 sshd[3237743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.216.178
country_id: 1861060
description:
Nov 14 02:22:17 host2 sshd[3237875]: Disconnected from invalid user edi 124.156.216.178 port 46366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:23:54 host2 sshd[3238658]: Disconnected from invalid user user123 143.110.137.94 port 55286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 14 02:25:12 host2 sshd[3239435]: Disconnected from invalid user cloud 92.185.99.40 port 34484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 14 02:26:26 host2 sshd[3240116]: Disconnected from invalid user postgres 92.185.99.40 port 41444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.216.178
country_id: 1861060
description:
Nov 14 02:26:45 host2 sshd[3240269]: Disconnected from invalid user wow 124.156.216.178 port 52198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.216.178
country_id: 1861060
description:
Nov 14 02:28:04 host2 sshd[3240801]: Disconnected from invalid user user3 124.156.216.178 port 52558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.219
country_id: 798544
description:
2025-11-14 02:29:15 dovecot_login authenticator failed for (ADMIN) [138.199.59.219]:57020: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 14 02:29:58 host2 sshd[3241909]: Disconnected from invalid user haproxy 92.185.99.40 port 52852 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.156.216.178
country_id: 1861060
description:
Nov 14 02:30:35 host2 sshd[3242521]: Disconnected from invalid user jia 124.156.216.178 port 53258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:31:21 host2 sshd[3243204]: Disconnected from invalid user edi 143.110.137.94 port 60026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-14 02:36:30 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (flare) [81.225.30.107]:58853: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:37:00 host2 sshd[3246447]: Disconnected from invalid user user3 143.110.137.94 port 45360 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:40:44 host2 sshd[3248706]: Disconnected from invalid user jerry 143.110.137.94 port 47380 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.191
country_id: 3017382
description:
Nov 14 02:43:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.191, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<R5yJW4BD5etbxJi/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.221
country_id: 3017382
description:
Nov 14 02:43:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.221, lip=66.85.158.91, TLS: Connection closed, session=<n6W5W4BDN5tbxJjd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.185
country_id: 3017382
description:
Nov 14 02:43:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.196.152.185, lip=66.85.158.91, TLS handshaking: Connection closed, session=<K/UdWoBDF7pbxJi5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.216
country_id: 3017382
description:
Nov 14 02:43:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.216, lip=66.85.158.91, TLS: Connection closed, session=<DWrhWoBDpYNbxJjY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.207
country_id: 6252001
description:
Nov 14 02:47:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.207, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kGd1aIBDx8fG6xjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-11-14 02:55:24 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (reburga) [24.1.200.187]:54822: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.75.222.34
country_id: 3077311
description:
Nov 14 02:55:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=217.75.222.34, lip=66.85.158.91, TLS, session=<3KgVhIBD+YjZS94i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.231.85
country_id: 798544
description:
Nov 14 02:54:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=193.43.231.85, lip=66.85.158.91, TLS, session=</w9mgoBD343BK+dV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-14 02:57:49 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42458: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-14 02:57:58 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:26392: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.120
country_id: 3703430
description:
2025-11-14 03:15:44 dovecot_login authenticator failed for (ADMIN) [91.90.126.120]:42584: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-11-14 03:17:29 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:58406: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-14 03:17:57 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:54902: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov 14 03:21:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<+crP4IBD2sOnXpI8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.129
country_id: 6252001
description:
Nov 14 03:21:19 host2 pure-ftpd[3273823]: (?@66.132.153.129) [INFO] New connection from 66.132.153.129


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.55
country_id: 6252001
description:
Nov 14 03:24:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.55, lip=66.85.158.91, TLS, session=<6/MZ7YBDZPiTuYQ3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.219
country_id: 3175395
description:
Nov 14 03:27:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.208.189.219, lip=66.85.158.91, TLS, session=<gnnl9YBDf4i50L3b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.155
country_id: 953987
description:
Nov 14 03:27:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.61.155, lip=66.85.158.91, TLS, session=<U4cO94BDIq9mgT2b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-14 03:31:50 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:58224: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-14 03:32:19 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:49167: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.169.197
country_id: 3469034
description:
Nov 14 03:33:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.130.169.197, lip=66.85.158.91, TLS, session=<VZv3C4FD2NixgqnF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.59
country_id: 3469034
description:
Nov 14 03:33:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=191.37.11.59, lip=66.85.158.91, TLS, session=<1XxJDYFD1IK/JQs7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.241.24
country_id: 290557
description:
Nov 14 03:33:52 host2 pure-ftpd[3281902]: (?@165.154.241.24) [INFO] New connection from 165.154.241.24


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 14 03:33:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS handshaking: Connection closed, session=<62EBDYFDnF1ChJl7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.97.141.134
country_id: 2635167
description:
Nov 14 03:33:28 host2 pure-ftpd[3281634]: (?@209.97.141.134) [INFO] New connection from 209.97.141.134


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Nov 14 03:35:55 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<dZrEFYFDQrOsaYAL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.239
country_id: 798544
description:
2025-11-14 03:39:28 dovecot_login authenticator failed for (ADMIN) [138.199.59.239]:55888: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.120.101
country_id: 6252001
description:
Nov 14 03:40:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.120.101, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<wkwCJ4FD+OsUqHhl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.57.141
country_id: 6252001
description:
Nov 14 03:41:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.57.141, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<I/0sKYFDHoAUajmN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-11-14 03:43:10 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (snonrapoly) [73.144.27.228]:57054: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-14 03:46:21 dovecot_plain authenticator failed for (mican) [12.150.243.22]:10592: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.248
country_id: 1733045
description:
2025-11-14 03:51:35 dovecot_login authenticator failed for ([49.124.150.248]) [49.124.150.248]:60404: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Nov 14 03:51:49 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS handshaking: Connection closed, session=<COShToFDVA5ChJmF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 03:53:09 host2 sshd[3296461]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.205
country_id: 6252001
description:
2025-11-14 03:57:15 dovecot_login authenticator failed for (ADMIN) [79.127.132.205]:24620: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 03:57:45 host2 sshd[3300766]: Disconnected from invalid user jaydon 62.60.131.157 port 49975 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 04:02:44 host2 sshd[3304917]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.190.38
country_id: 3175395
description:
Nov 14 04:09:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.208.190.38, lip=66.85.158.91, TLS, session=<l3LNjIFDHo650L4m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.42
country_id: 2510769
description:
Nov 14 04:09:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=139.28.190.42, lip=66.85.158.91, TLS, session=<YFjmjYFDJcWLHL4q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 04:12:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63842: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.121
country_id: 6252001
description:
Nov 14 04:14:44 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.121, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<z+qSoIFDONnG6xh5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.14
country_id: 290557
description:
2025-11-14 04:17:45 dovecot_login authenticator failed for (ADMIN) [217.138.162.14]:56446: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.87
country_id: 2635167
description:
Nov 14 04:21:10 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.87, lip=66.85.158.91, session=<fMKft4FDpuMjy9JX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-11-14 04:21:45 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (fingly) [24.15.216.41]:36018: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.142.136.45
country_id: 6252001
description:
[2025-11-14 04:22:35 +0530] info [cpaneld] 40.142.136.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.21.246
country_id: 6252001
description:
[2025-11-14 04:22:36 +0530] info [cpaneld] 152.42.21.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.63.16.176
country_id: 6252001
description:
[2025-11-14 04:22:50 +0530] info [cpaneld] 71.63.16.176 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.59.7.100
country_id: 6252001
description:
[2025-11-14 04:22:52 +0530] info [whostmgrd] 173.59.7.100 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.247.33.60
country_id: 6252001
description:
[2025-11-14 04:23:03 +0530] info [cpaneld] 63.247.33.60 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.12.186.253
country_id: 6252001
description:
[2025-11-14 04:23:13 +0530] info [cpaneld] 172.12.186.253 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.86.191.114
country_id: 6252001
description:
[2025-11-14 04:23:14 +0530] info [cpaneld] 174.86.191.114 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.92
country_id: 6252001
description:
Nov 14 04:27:53 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.92, lip=66.85.158.91, TLS, session=<zbSlz4FD8O7N0h9c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.119.37.24
country_id: 6252001
description:
[2025-11-14 04:30:03 +0530] info [whostmgrd] 172.119.37.24 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.203.89.130
country_id: 6252001
description:
[2025-11-14 04:29:41 +0530] info [cpaneld] 71.203.89.130 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.87.18.81
country_id: 6252001
description:
[2025-11-14 04:29:46 +0530] info [cpaneld] 172.87.18.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.79.109.53
country_id: 6252001
description:
[2025-11-14 04:29:54 +0530] info [cpaneld] 74.79.109.53 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.95.137.26
country_id: 6252001
description:
[2025-11-14 04:30:19 +0530] info [cpaneld] 71.95.137.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.87.168.89
country_id: 6252001
description:
[2025-11-14 04:30:21 +0530] info [cpaneld] 108.87.168.89 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-11-14 04:36:26 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:54830: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-11-14 04:36:40 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:34773: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:36:49 host2 sshd[3337220]: Disconnected from invalid user felix 101.36.116.29 port 54576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.88
country_id: 6251999
description:
2025-11-14 04:37:18 dovecot_login authenticator failed for (ADMIN) [66.56.80.88]:19599: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.244
country_id: 3469034
description:
Nov 14 04:40:08 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.53.165.244, lip=66.85.158.91, TLS, session=<MoVJ+oFDhM2xNaX0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.124
country_id: 3175395
description:
Nov 14 04:40:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.169.124, lip=66.85.158.91, TLS, session=<fVeD+4FDBJW5D6l8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:41:02 host2 sshd[3339581]: Disconnected from invalid user visitor 101.36.116.29 port 51150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-14 04:41:55 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:51420: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-14 04:42:10 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:35352: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:42:23 host2 sshd[3340173]: Disconnected from invalid user ftpuser 101.36.116.29 port 38744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.88
country_id: 298795
description:
Nov 14 04:43:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=95.0.32.88, lip=66.85.158.91, TLS, session=<Wg9mBYJDFLxfACBY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.217
country_id: 3469034
description:
Nov 14 04:43:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=138.255.206.217, lip=66.85.158.91, TLS, session=<6U6QBoJDTL6K/87Z>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Nov 14 04:46:15 host2 sshd[3343036]: Disconnected from invalid user ammar 117.220.10.3 port 50969 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 04:46:48 host2 sshd[3343267]: Disconnected from invalid user landen 62.60.131.157 port 43555 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:47:53 host2 sshd[3343824]: Disconnected from invalid user teamspeak 101.36.116.29 port 39480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:49:26 host2 sshd[3344917]: Disconnected from invalid user systems 101.36.116.29 port 35860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-14 04:52:27 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:51586: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-11-14 04:52:55 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:33244: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-14 04:54:52 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:52222: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2025-11-14 04:55:06 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:57123: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 04:55:18 host2 sshd[3349143]: Disconnected from invalid user admin 124.156.194.158 port 47758 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.82.203.138
country_id: 3469034
description:
[2025-11-14 04:56:50 +0530] info [whostmgrd] 170.82.203.138 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.220.10.3
country_id: 1269750
description:
Nov 14 04:57:14 host2 sshd[3350421]: Disconnected from invalid user hik 117.220.10.3 port 51281 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 04:58:07 host2 sshd[3350872]: Disconnected from invalid user arjun 124.156.194.158 port 56764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Nov 14 05:00:44 host2 sshd[3352818]: Disconnected from invalid user elsearch 117.220.10.3 port 55808 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.27.203.82
country_id: 1605651
description:
[2025-11-14 05:01:13 +0530] info [webmaild] 103.27.203.82 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 05:02:08 host2 sshd[3353591]: Disconnected from invalid user sammy 124.156.194.158 port 39254 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.12.223.154
country_id: 1814991
description:
[2025-11-14 05:03:00 +0530] info [cpaneld] 183.12.223.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.215.255
country_id: 1733045
description:
[2025-11-14 05:03:03 +0530] info [cpaneld] 113.211.215.255 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.117.17.100
country_id: 6252001
description:
[2025-11-14 05:03:07 +0530] info [cpaneld] 69.117.17.100 - dragon "GET /login/?login_only=1&user=dragon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.0.153
country_id: 290291
description:
[2025-11-14 05:03:11 +0530] info [whostmgrd] 88.201.0.153 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.61.99.160
country_id: 2510769
description:
[2025-11-14 05:03:25 +0530] info [cpaneld] 81.61.99.160 - drago "GET /login/?login_only=1&user=drago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.215.169.13
country_id: 3017382
description:
[2025-11-14 05:03:34 +0530] info [cpaneld] 109.215.169.13 - dra "GET /login/?login_only=1&user=dra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.71.253.161
country_id: 3469034
description:
[2025-11-14 05:03:18 +0530] info [cpaneld] 189.71.253.161 - dragonlk "GET /login/?login_only=1&user=dragonlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dragonlk (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.170.40.70
country_id: 6252001
description:
Nov 14 05:03:22 host2 pure-ftpd[3354611]: (?@107.170.40.70) [INFO] New connection from 107.170.40.70


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.195.44
country_id: 1562822
description:
[2025-11-14 05:03:27 +0530] info [cpaneld] 14.191.195.44 - drag "GET /login/?login_only=1&user=drag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.120.200.167
country_id: 357994
description:
[2025-11-14 05:03:36 +0530] info [cpaneld] 197.120.200.167 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.112
country_id: 3469034
description:
Nov 14 05:03:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=168.0.224.112, lip=66.85.158.91, TLS, session=<sRp+T4JDdbeoAOBw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Nov 14 05:04:13 host2 sshd[3355100]: Disconnected from invalid user egarcia 117.220.10.3 port 43536 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.63.28
country_id: 3469034
description:
Nov 14 05:04:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=177.85.63.28, lip=66.85.158.91, TLS, session=<RejDUIJDLbmxVT8c>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 05:04:41 host2 sshd[3355294]: Disconnected from invalid user agent 124.156.194.158 port 33296 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.68
country_id: 2264397
description:
Nov 14 05:06:36 host2 pure-ftpd[3356369]: (?@109.105.210.68) [INFO] New connection from 109.105.210.68


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.69
country_id: 2264397
description:
Nov 14 05:06:35 host2 pure-ftpd[3356365]: (?@109.105.210.69) [INFO] New connection from 109.105.210.69


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.67
country_id: 2264397
description:
Nov 14 05:06:36 host2 pure-ftpd[3356381]: (?@109.105.210.67) [INFO] New connection from 109.105.210.67


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.70
country_id: 2264397
description:
Nov 14 05:06:37 host2 pure-ftpd[3356392]: (?@109.105.210.70) [INFO] New connection from 109.105.210.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.164.39.32
country_id: 3202326
description:
2025-11-14 05:09:28 dovecot_plain authenticator failed for 39-32.dsl.iskon.hr ([31.57.166.48]) [89.164.39.32]:51470: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 05:09:59 host2 sshd[3358031]: Disconnected from invalid user omer 124.156.194.158 port 32992 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.62.163
country_id: 6252001
description:
[2025-11-14 05:14:10 +0530] info [cpaneld] 47.151.62.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.117.47.172
country_id: 6252001
description:
[2025-11-14 05:14:12 +0530] info [cpaneld] 73.117.47.172 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.56.190.64
country_id: 6252001
description:
[2025-11-14 05:14:41 +0530] info [whostmgrd] 108.56.190.64 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.12.43.147
country_id: 6252001
description:
[2025-11-14 05:14:46 +0530] info [cpaneld] 24.12.43.147 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.207.163.132
country_id: 6252001
description:
[2025-11-14 05:14:50 +0530] info [cpaneld] 98.207.163.132 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.34.108.54
country_id: 6252001
description:
[2025-11-14 05:15:05 +0530] info [cpaneld] 73.34.108.54 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.19.159
country_id: 6252001
description:
[2025-11-14 05:17:32 +0530] info [cpaneld] 47.150.19.159 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.156.49.86
country_id: 6252001
description:
[2025-11-14 05:17:36 +0530] info [cpaneld] 47.156.49.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.107.167.30
country_id: 6252001
description:
[2025-11-14 05:17:48 +0530] info [cpaneld] 174.107.167.30 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.117.220.255
country_id: 6252001
description:
[2025-11-14 05:18:01 +0530] info [whostmgrd] 99.117.220.255 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.253.38
country_id: 6252001
description:
[2025-11-14 05:18:06 +0530] info [cpaneld] 172.58.253.38 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.236.172.85
country_id: 6252001
description:
[2025-11-14 05:18:13 +0530] info [cpaneld] 24.236.172.85 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.136.130.96
country_id: 6252001
description:
[2025-11-14 05:18:18 +0530] info [cpaneld] 69.136.130.96 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 14 05:18:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<Kk6zhYJD7oNChJlx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.75
country_id: 2264397
description:
Nov 14 05:19:40 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.75, lip=66.85.158.92, TLS, session=<0gXViIJD6s0tnIFL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.76
country_id: 2264397
description:
Nov 14 05:19:40 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.76, lip=66.85.158.92, TLS, session=<r/DSiIJDp8EtnIFM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.76
country_id: 2264397
description:
Nov 14 05:19:40 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.129.76, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<YMrYiIJDKdItnIFM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.78
country_id: 2264397
description:
Nov 14 05:19:41 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.78, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<n6rciIJDN9ktnIFO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.6.240
country_id: 6252001
description:
2025-11-14 05:22:06 dovecot_plain authenticator failed for c-71-62-6-240.hsd1.va.comcast.net (skswoo) [71.62.6.240]:60044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 80.82.77.139
country_id: 2750405
description:
Nov 14 05:22:09 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=66.85.158.91, TLS, session=<k3q1kYJDjuhQUk2L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.50
country_id: 732800
description:
2025-11-14 05:22:34 dovecot_login authenticator failed for (ADMIN) [94.156.14.50]:35802: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Nov 14 05:22:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<xqi+kYJDbO1QUk2L>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.239
country_id: 6252001
description:
Nov 14 05:25:59 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.132.239, lip=66.85.158.92, session=<5whvn4JDLOaTuYTv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 05:33:39 host2 sshd[3370904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-11-14 05:33:13 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:34710: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.101.69
country_id: 3144096
description:
2025-11-14 05:33:28 dovecot_login authenticator failed for ([46.212.101.69]) [46.212.101.69]:38766: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-11-14 05:33:44 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:57874: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.4
country_id: 1733045
description:
2025-11-14 05:33:49 dovecot_login authenticator failed for ([49.124.153.4]) [49.124.153.4]:50346: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-14 05:34:21 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:47708: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.219.114.145
country_id: 3996063
description:
[2025-11-14 05:35:38 +0530] info [whostmgrd] 189.219.114.145 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-11-14 05:40:24 +0530] info [cpaneld] 117.103.80.92 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Nov 14 05:42:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jtoi2YJDB8nG6xh2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 14 05:42:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<sYnr2YJD9OGLonQW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 05:43:16 host2 sshd[3375610]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.132
country_id: 2635167
description:
Nov 14 05:44:20 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.132, lip=66.85.158.91, TLS, session=<zqUB4YJDE8ZX7LCE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.56
country_id: 3175395
description:
Nov 14 05:45:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=195.177.113.56, lip=66.85.158.91, TLS, session=<YZjL44JD4rrDsXE4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.38.145
country_id: 953987
description:
Nov 14 05:45:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.64.38.145, lip=66.85.158.91, TLS, session=<CQ355IJDRaRmQCaR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.48
country_id: 3625428
description:
2025-11-14 05:47:36 dovecot_login authenticator failed for (ADMIN) [95.181.237.48]:41906: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.52
country_id: 1733045
description:
2025-11-14 05:55:58 dovecot_login authenticator failed for ([49.124.149.52]) [49.124.149.52]:50602: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.52.132
country_id: 6252001
description:
[2025-11-14 05:56:39 +0530] info [whostmgrd] 172.58.52.132 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.33.133
country_id: 6252001
description:
[2025-11-14 05:57:03 +0530] info [whostmgrd] 184.164.33.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.80.71.87
country_id: 1861060
description:
2025-11-14 05:56:30 dovecot_login authenticator failed for 58x80x71x87.ap58.ftth.ucom.ne.jp [58.80.71.87]:46464: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.241.213.133
country_id: 3895114
description:
[2025-11-14 05:58:17 +0530] info [whostmgrd] 201.241.213.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-11-14 05:58:36 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:57347: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.203.231.87
country_id: 6252001
description:
[2025-11-14 05:59:59 +0530] info [whostmgrd] 170.203.231.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Nov 14 06:00:35 host2 sshd[3386817]: Disconnected from invalid user test 93.113.63.124 port 57446 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Nov 14 06:04:21 host2 sshd[3389014]: Disconnected from invalid user nam 93.113.63.124 port 37378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.182.148.37
country_id: 3658394
description:
Nov 14 06:04:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=201.182.148.37, lip=66.85.158.91, TLS, session=<Kh02KYNDeuPJtpQl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.211
country_id: 3175395
description:
Nov 14 06:05:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=171.22.234.211, lip=66.85.158.91, TLS, session=<KBJXKoNDZYKrFurT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Nov 14 06:05:32 host2 sshd[3389744]: Disconnected from invalid user foundry 93.113.63.124 port 53310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 06:06:47 host2 sshd[3390437]: Disconnected from invalid user  2.57.121.112 port 62955 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.190
country_id: 2510769
description:
2025-11-14 06:07:18 dovecot_login authenticator failed for (ADMIN) [212.102.49.190]:59307: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.238
country_id: 6252001
description:
Nov 14 06:07:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.238, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZBoRNYNDYtjG6xju>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 14 06:14:44 host2 sshd[3394962]: Invalid user cloudtourssrilan_travel from 182.8.225.116 port 13367


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.116
country_id: 1643084
description:
[2025-11-14 06:14:45 +0530] info [cpaneld] 182.8.225.116 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.154
country_id: 3469034
description:
Nov 14 06:14:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.8.251.154, lip=66.85.158.91, TLS, session=<fTbvS4ND8p+xCPua>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 14 06:14:43 host2 pure-ftpd[3394959]: (?@182.8.225.116) [INFO] New connection from 182.8.225.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-14 06:15:05 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:52661: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.204
country_id: 3175395
description:
Nov 14 06:14:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.170.204, lip=66.85.158.91, TLS, session=<7nEWTYNDQ+S5D6rM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-14 06:15:27 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:45422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.116
country_id: 1643084
description:
[2025-11-14 06:16:20 +0530] info [cpaneld] 182.8.225.116 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 14 06:16:19 host2 sshd[3395878]: Invalid user cloudtourssrilan_travel from 182.8.225.116 port 43936


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 14 06:16:17 host2 pure-ftpd[3395874]: (?@182.8.225.116) [INFO] New connection from 182.8.225.116


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.46.147.157
country_id: 6252001
description:
[2025-11-14 06:18:05 +0530] info [whostmgrd] 99.46.147.157 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.113.20.208
country_id: 3895114
description:
[2025-11-14 06:22:26 +0530] info [whostmgrd] 191.113.20.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.68.122.214
country_id: 953987
description:
[2025-11-14 06:25:38 +0530] info [whostmgrd] 102.68.122.214 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.25.40
country_id: 3686110
description:
[2025-11-14 06:25:39 +0530] info [whostmgrd] 181.189.25.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov 14 06:25:53 host2 pure-ftpd[3400539]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.29.135
country_id: 6252001
description:
[2025-11-14 06:28:03 +0530] info [cpaneld] 76.37.29.135 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.231.133.99
country_id: 6252001
description:
[2025-11-14 06:28:21 +0530] info [whostmgrd] 104.231.133.99 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.198.169.217
country_id: 6252001
description:
[2025-11-14 06:28:36 +0530] info [cpaneld] 47.198.169.217 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.7.181.190
country_id: 3469034
description:
[2025-11-14 06:28:57 +0530] info [whostmgrd] 177.7.181.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.146.78
country_id: 6252001
description:
[2025-11-14 06:28:12 +0530] info [cpaneld] 76.39.146.78 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.211.154.151
country_id: 6252001
description:
[2025-11-14 06:28:14 +0530] info [cpaneld] 72.211.154.151 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.49.42
country_id: 6252001
description:
[2025-11-14 06:28:24 +0530] info [cpaneld] 172.58.49.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.13.127.160
country_id: 6252001
description:
[2025-11-14 06:28:47 +0530] info [cpaneld] 172.13.127.160 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.134.90
country_id: 3658394
description:
[2025-11-14 06:31:22 +0530] info [whostmgrd] 157.100.134.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.94.249.18
country_id: 3469034
description:
[2025-11-14 06:31:32 +0530] info [whostmgrd] 177.94.249.18 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.128.110.158
country_id: 953987
description:
Nov 14 06:32:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.128.110.158, lip=66.85.158.91, TLS, session=<FfLajINDvp1mgG6e>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.194.121.154
country_id: 290557
description:
[2025-11-14 06:32:10 +0530] info [whostmgrd] 5.194.121.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.70
country_id: 3175395
description:
Nov 14 06:32:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=217.26.178.70, lip=66.85.158.91, TLS, session=<Y+20i4ND0ITZGrJG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.177.238.104
country_id: 290557
description:
[2025-11-14 06:33:45 +0530] info [whostmgrd] 109.177.238.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.116
country_id: 1831722
description:
2025-11-14 06:34:01 dovecot_login authenticator failed for (ADMIN) [188.215.235.116]:33423: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.97.180.94
country_id: 3469034
description:
Nov 14 06:34:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=138.97.180.94, lip=66.85.158.91, TLS, session=<dXUfkoNDTpOKYbRe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.155
country_id: 3175395
description:
Nov 14 06:34:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.171.155, lip=66.85.158.91, TLS, session=<8r9Dk4NDRby5D6ub>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.108.12.155
country_id: 3439705
description:
[2025-11-14 06:36:37 +0530] info [whostmgrd] 190.108.12.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.153.19.215
country_id: 3625428
description:
[2025-11-14 06:38:14 +0530] info [whostmgrd] 190.153.19.215 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.168
country_id: 2635167
description:
Nov 14 06:39:31 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.168, lip=66.85.158.92, TLS, session=<bERbpoND36G594mo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.181.80
country_id: 1861060
description:
2025-11-14 06:45:56 dovecot_login authenticator failed for m106153181080.v4.enabler.ne.jp [106.153.181.80]:41674: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-14 06:46:10 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:50659: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 06:49:14 host2 sshd[3415558]: Disconnected from invalid user admin 2.57.121.112 port 17397 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.234.237
country_id: 6252001
description:
2025-11-14 06:52:08 dovecot_login authenticator failed for (ADMIN) [102.129.234.237]:43695: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.182.103.137
country_id: 6252001
description:
[2025-11-14 06:53:56 +0530] info [cpaneld] 163.182.103.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.82.84.201
country_id: 6252001
description:
[2025-11-14 06:54:05 +0530] info [cpaneld] 161.82.84.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 14 06:55:31 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, TLS: Connection closed, session=<fcag34NDNAtChJl/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.205.235.112
country_id: 6252001
description:
[2025-11-14 06:59:22 +0530] info [whostmgrd] 107.205.235.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.57.6.12
country_id: 6252001
description:
[2025-11-14 06:59:30 +0530] info [cpaneld] 68.57.6.12 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.149.84.178
country_id: 6252001
description:
[2025-11-14 06:59:40 +0530] info [cpaneld] 99.149.84.178 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.152.122
country_id: 6252001
description:
[2025-11-14 06:59:49 +0530] info [cpaneld] 38.194.152.122 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.106.176.236
country_id: 6252001
description:
[2025-11-14 06:59:10 +0530] info [cpaneld] 174.106.176.236 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.19.113.82
country_id: 6252001
description:
[2025-11-14 06:59:14 +0530] info [cpaneld] 45.19.113.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.194.173.61
country_id: 6252001
description:
[2025-11-14 06:59:19 +0530] info [cpaneld] 162.194.173.61 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.117.191.173
country_id: 6252001
description:
[2025-11-14 06:59:59 +0530] info [cpaneld] 99.117.191.173 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.219.2.94
country_id: 6252001
description:
[2025-11-14 07:00:09 +0530] info [cpaneld] 147.219.2.94 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.130.124.132
country_id: 6252001
description:
[2025-11-14 07:00:15 +0530] info [cpaneld] 72.130.124.132 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.221.191
country_id: 6252001
description:
[2025-11-14 06:59:55 +0530] info [cpaneld] 73.2.221.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.225.144
country_id: 6252001
description:
[2025-11-14 07:00:01 +0530] info [cpaneld] 47.152.225.144 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.27.181
country_id: 6252001
description:
[2025-11-14 07:00:03 +0530] info [whostmgrd] 172.56.27.181 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.72.193.67
country_id: 6252001
description:
[2025-11-14 07:00:20 +0530] info [cpaneld] 173.72.193.67 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 07:03:31 host2 sshd[3425446]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.39.5.72
country_id: 102358
description:
[2025-11-14 07:03:44 +0530] info [whostmgrd] 51.39.5.72 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.194.153.188
country_id: 2510769
description:
[2025-11-14 07:05:59 +0530] info [whostmgrd] 213.194.153.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.30.1.241
country_id: 6252001
description:
[2025-11-14 07:07:10 +0530] info [whostmgrd] 98.30.1.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-14 07:13:45 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:56276: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 07:14:21 host2 sshd[3432541]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.22
country_id: 6252001
description:
Nov 14 07:23:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5qUqQ4RD1YHDuEwW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Nov 14 07:23:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.18, lip=66.85.158.91, TLS: Connection closed, session=<xLXTQ4RDO+rDuEwS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.112
country_id: 6252001
description:
Nov 14 07:23:41 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.112, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<e7laRIRD9ebDuExw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.20
country_id: 6252001
description:
Nov 14 07:23:44 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.20, lip=66.85.158.91, TLS: Connection closed, session=<L6yJRIRDIYHDuEwU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 07:23:58 host2 sshd[3438413]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.171
country_id: 3469034
description:
Nov 14 07:23:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.44.96.171, lip=66.85.158.91, TLS, session=<oLA+RIRDxdKxLGCr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.148.225
country_id: 690791
description:
Nov 14 07:24:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=37.221.148.225, lip=66.85.158.91, TLS, session=</iZqRYRDheMl3ZTh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 07:26:14 host2 sshd[3439537]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.38.199.53
country_id: 6252001
description:
[2025-11-14 07:26:34 +0530] info [cpaneld] 24.38.199.53 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.252.220.111
country_id: 6252001
description:
[2025-11-14 07:26:36 +0530] info [cpaneld] 195.252.220.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.244.3
country_id: 1282988
description:
[2025-11-14 07:26:38 +0530] info [whostmgrd] 103.225.244.3 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.144.35.157
country_id: 6252001
description:
[2025-11-14 07:26:47 +0530] info [cpaneld] 67.144.35.157 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.160.92
country_id: 6252001
description:
[2025-11-14 07:26:49 +0530] info [whostmgrd] 47.149.160.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.50.240.221
country_id: 6252001
description:
[2025-11-14 07:26:54 +0530] info [cpaneld] 104.50.240.221 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.17.72.31
country_id: 6252001
description:
[2025-11-14 07:27:00 +0530] info [cpaneld] 47.17.72.31 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-11-14 07:27:30 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (ovenite) [24.98.45.238]:49966: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.223.22.105
country_id: 6252001
description:
[2025-11-14 07:26:53 +0530] info [cpaneld] 108.223.22.105 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.121.161.67
country_id: 6252001
description:
[2025-11-14 07:28:30 +0530] info [whostmgrd] 23.121.161.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.96.97.195
country_id: 290557
description:
[2025-11-14 07:30:28 +0530] info [whostmgrd] 86.96.97.195 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.180.81
country_id: 587116
description:
[2025-11-14 07:31:46 +0530] info [whostmgrd] 37.114.180.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Nov 14 07:32:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<54UfYoRD6utAPpzU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.137.80.146
country_id: 2510769
description:
[2025-11-14 07:32:33 +0530] info [whostmgrd] 2.137.80.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.202.156.153
country_id: 6252001
description:
[2025-11-14 07:32:44 +0530] info [cpaneld] 73.202.156.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.239.37
country_id: 6252001
description:
[2025-11-14 07:32:47 +0530] info [cpaneld] 73.15.239.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.100.226.165
country_id: 6252001
description:
[2025-11-14 07:33:09 +0530] info [whostmgrd] 97.100.226.165 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.82.89.25
country_id: 6252001
description:
[2025-11-14 07:33:24 +0530] info [whostmgrd] 71.82.89.25 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.65.160.55
country_id: 6252001
description:
[2025-11-14 07:33:32 +0530] info [cpaneld] 73.65.160.55 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.250.232
country_id: 6252001
description:
[2025-11-14 07:33:35 +0530] info [cpaneld] 73.199.250.232 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.102.64.229
country_id: 6252001
description:
[2025-11-14 07:33:38 +0530] info [cpaneld] 73.102.64.229 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.241.87
country_id: 6252001
description:
[2025-11-14 07:33:54 +0530] info [whostmgrd] 99.44.241.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.248.222.22
country_id: 3895114
description:
[2025-11-14 07:34:09 +0530] info [whostmgrd] 207.248.222.22 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.9
country_id: 3057568
description:
2025-11-14 07:35:22 dovecot_login authenticator failed for (ADMIN) [149.102.232.9]:27582: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.196.42.124
country_id: 6252001
description:
Nov 14 07:35:22 host2 pure-ftpd[3444896]: (?@132.196.42.124) [INFO] New connection from 132.196.42.124


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.228
country_id: 1880251
description:
Nov 14 07:35:37 host2 sshd[3444983]: Disconnected from invalid user kafka 45.78.206.228 port 51516 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.204.62.47
country_id: 3469034
description:
[2025-11-14 07:37:23 +0530] info [whostmgrd] 186.204.62.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 07:38:09 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=217.119.139.27, lip=66.85.158.91, session=<XocZeIRDpoDZd4sb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:38:10 host2 sshd[3446010]: Disconnected from invalid user guo 130.185.76.118 port 45190 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.180.165.160
country_id: 3469034
description:
[2025-11-14 07:39:05 +0530] info [whostmgrd] 187.180.165.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:39:58 host2 sshd[3447108]: Disconnected from invalid user jj 130.185.76.118 port 34466 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.55.158.171
country_id: 3865483
description:
[2025-11-14 07:40:19 +0530] info [whostmgrd] 190.55.158.171 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:42:29 host2 sshd[3448731]: Disconnected from invalid user rstudio 130.185.76.118 port 50034 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.235.55.152
country_id: 1269750
description:
[2025-11-14 07:42:34 +0530] info [whostmgrd] 117.235.55.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:43:43 host2 sshd[3449310]: Disconnected from invalid user st 130.185.76.118 port 44494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 14 07:43:25 host2 sshd[3449174]: Disconnected from invalid user ossuser 103.56.30.33 port 32650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 14 07:44:49 host2 sshd[3450508]: Disconnected from invalid user hunter 103.56.30.33 port 26142 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.127.31
country_id: 2017370
description:
[2025-11-14 07:45:43 +0530] info [whostmgrd] 146.158.127.31 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.45.133
country_id: 6252001
description:
[2025-11-14 07:45:41 +0530] info [whostmgrd] 98.97.45.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.174.239.61
country_id: 3469034
description:
[2025-11-14 07:45:04 +0530] info [whostmgrd] 45.174.239.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:45:06 host2 sshd[3450881]: Disconnected from invalid user git 130.185.76.118 port 56076 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 14 07:46:15 host2 sshd[3452025]: Disconnected from invalid user dan 103.56.30.33 port 23232 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.175.226.208
country_id: 6252001
description:
[2025-11-14 07:46:48 +0530] info [whostmgrd] 174.175.226.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.98.88.203
country_id: 6252001
description:
[2025-11-14 07:46:54 +0530] info [whostmgrd] 184.98.88.203 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.134
country_id: 617790
description:
Nov 14 07:47:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=178.175.142.134, lip=66.85.158.91, session=<+Q3al4RDcMayr46G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.153
country_id: 2993457
description:
Nov 14 07:47:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.233.153, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hWTZl4RDupRftemZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.150
country_id: 2993457
description:
Nov 14 07:47:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=95.181.233.150, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TX34l4RDIqVftemW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 07:47:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59976: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Nov 14 07:48:42 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uT7GnYRDhI5ChJmB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.232.214.145
country_id: 3175395
description:
[2025-11-14 07:50:23 +0530] info [whostmgrd] 95.232.214.145 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 14 07:52:31 host2 sshd[3455542]: Disconnected from invalid user mongod 103.154.77.48 port 40942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-14 07:52:40 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:48710: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-14 07:52:57 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:13573: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.150.195.172
country_id: 6252001
description:
Nov 14 07:53:31 host2 pure-ftpd[3456287]: (?@20.150.195.172) [INFO] New connection from 20.150.195.172


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 14 07:55:10 host2 sshd[3458240]: Disconnected from invalid user naveen 103.154.77.48 port 36832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 07:55:33 host2 sshd[3458426]: Disconnected from invalid user ubnt 2.57.121.112 port 62943 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 14 07:56:21 host2 sshd[3458969]: Disconnected from invalid user elasticsearch 103.154.77.48 port 34770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.3.213
country_id: 2661886
description:
2025-11-14 07:57:52 dovecot_login authenticator failed for (ADMIN) [46.246.3.213]:8497: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.180.231.157
country_id: 3469034
description:
[2025-11-14 07:56:57 +0530] info [whostmgrd] 187.180.231.157 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 14 07:57:36 host2 sshd[3459679]: Disconnected from invalid user steam 103.154.77.48 port 60940 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 14 07:58:22 host2 sshd[3460101]: Disconnected from invalid user barbara 155.94.170.106 port 47476 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.148.128.22
country_id: 3595528
description:
[2025-11-14 07:58:50 +0530] info [whostmgrd] 190.148.128.22 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.228
country_id: 1880251
description:
Nov 14 07:59:14 host2 sshd[3460846]: Disconnected from invalid user cacti 45.78.206.228 port 45350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.153.132.112
country_id: 1269750
description:
Nov 14 07:59:41 host2 sshd[3461024]: Disconnected from invalid user stephen 20.153.132.112 port 46682 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.73
country_id: 6252001
description:
Nov 14 07:59:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.73, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JmzrxYRD5sjN0h9J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.228
country_id: 1880251
description:
Nov 14 08:01:42 host2 sshd[3462475]: Disconnected from invalid user jj 45.78.206.228 port 57352 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.22.167.1
country_id: 3658394
description:
[2025-11-14 08:00:54 +0530] info [whostmgrd] 171.22.167.1 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.35.14.155
country_id: 6252001
description:
[2025-11-14 08:02:10 +0530] info [whostmgrd] 99.35.14.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 08:02:16 host2 sshd[3462801]: Disconnected from invalid user user 2.57.121.25 port 33217 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 08:02:18 host2 sshd[3462864]: Disconnected from invalid user  2.57.121.112 port 61847 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.136.89.12
country_id: 3865483
description:
[2025-11-14 08:02:32 +0530] info [whostmgrd] 190.136.89.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.153.132.112
country_id: 1269750
description:
Nov 14 08:03:49 host2 sshd[3464113]: Disconnected from invalid user flash 20.153.132.112 port 46398 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.191.114.186
country_id: 6252001
description:
[2025-11-14 08:03:28 +0530] info [whostmgrd] 75.191.114.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.156.98.112
country_id: 1269750
description:
[2025-11-14 08:04:11 +0530] info [whostmgrd] 49.156.98.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.167
country_id: 6252001
description:
Nov 14 08:04:02 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.132.167, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<21+g1IRDWdKTuYSn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.233.57
country_id: 6252001
description:
[2025-11-14 08:05:30 +0530] info [cpaneld] 45.17.233.57 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.220.21.162
country_id: 6252001
description:
[2025-11-14 08:05:34 +0530] info [cpaneld] 47.220.21.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.94.199.25
country_id: 6252001
description:
[2025-11-14 08:05:42 +0530] info [whostmgrd] 71.94.199.25 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.114.91
country_id: 6252001
description:
[2025-11-14 08:06:15 +0530] info [cpaneld] 96.241.114.91 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.207.116.253
country_id: 6252001
description:
[2025-11-14 08:06:33 +0530] info [cpaneld] 75.207.116.253 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.43.243.240
country_id: 6252001
description:
[2025-11-14 08:05:55 +0530] info [whostmgrd] 68.43.243.240 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.37.89.224
country_id: 6252001
description:
[2025-11-14 08:06:06 +0530] info [cpaneld] 136.37.89.224 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.3.3.188
country_id: 298795
description:
[2025-11-14 08:06:16 +0530] info [whostmgrd] 188.3.3.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.167
country_id: 6252001
description:
Nov 14 08:09:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.167, lip=66.85.158.92, TLS, session=<9xYT6IRDruGTuYSn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.123.22
country_id: 6252001
description:
Nov 14 08:09:42 host2 sshd[3467236]: Disconnected from invalid user ec2-user 198.12.123.22 port 52320 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.223
country_id: 6252001
description:
Nov 14 08:10:23 host2 pure-ftpd[3467791]: (?@198.235.24.223) [INFO] New connection from 198.235.24.223


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.115
country_id: 2635167
description:
Nov 14 08:11:58 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.115, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<pnb78IRDg9Ijy9Jz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.123.22
country_id: 6252001
description:
Nov 14 08:12:38 host2 sshd[3469012]: Disconnected from invalid user sftpuser 198.12.123.22 port 44682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 08:12:42 host2 sshd[3468998]: Disconnected from invalid user magdalena 62.60.131.157 port 16368 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.124.49.49
country_id: 2542007
description:
[2025-11-14 08:12:56 +0530] info [whostmgrd] 196.124.49.49 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.115
country_id: 2635167
description:
Nov 14 08:17:55 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.115, lip=66.85.158.91, TLS, session=<w7ZMBoVDKOYjy9Jz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.86
country_id: 6252001
description:
2025-11-14 08:19:27 dovecot_login authenticator failed for (ADMIN) [173.244.56.86]:7838: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.123.22
country_id: 6252001
description:
Nov 14 08:19:30 host2 sshd[3473285]: Disconnected from invalid user xyx 198.12.123.22 port 52032 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.235.169.135
country_id: 798544
description:
[2025-11-14 08:20:23 +0530] info [whostmgrd] 178.235.169.135 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.89.220.58
country_id: 3469034
description:
[2025-11-14 08:22:25 +0530] info [whostmgrd] 189.89.220.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.123.22
country_id: 6252001
description:
Nov 14 08:25:49 host2 sshd[3477140]: Disconnected from invalid user username1 198.12.123.22 port 44310 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.178.110.152
country_id: 732800
description:
Nov 14 08:28:14 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.178.110.152, lip=66.85.158.91, session=<FMgtK4VDQNrDsm6Y>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.178.110.152
country_id: 732800
description:
Nov 14 08:28:13 host2 pure-ftpd[3478581]: (?@195.178.110.152) [INFO] New connection from 195.178.110.152


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.10
country_id: 3175395
description:
Nov 14 08:32:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.77.50.10, lip=66.85.158.91, TLS, session=<3L2nN4VDXLC5TTIK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.219.201.67
country_id: 953987
description:
Nov 14 08:32:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.219.201.67, lip=66.85.158.91, TLS, session=<m6ffOIVDjbFm28lD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.95
country_id: 1269750
description:
Nov 14 08:36:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.18.166.95, lip=66.85.158.91, TLS, session=<i0FQSYVDV5pnEqZf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.105
country_id: 732800
description:
Nov 14 08:37:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.255.212.105, lip=66.85.158.91, TLS, session=<3F2QSoVDQOa5/9Rp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 08:39:13 host2 sshd[3484616]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-14 08:40:10 dovecot_plain authenticator failed for (ouffs) [2.55.122.202]:38535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-14 08:40:13 dovecot_plain authenticator failed for (foonism) [92.62.243.174]:58505: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-14 08:41:03 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:37960: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.245
country_id: 2635167
description:
Nov 14 08:45:18 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.245, lip=66.85.158.91, TLS, session=<iTk0aIVDD61X7LD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.162
country_id: 2635167
description:
Nov 14 08:45:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.162, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<MJ5baYVD28FX7LCi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.159
country_id: 2635167
description:
Nov 14 08:46:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.159, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Jb9Xa4VDcYm594mf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.226
country_id: 1269750
description:
Nov 14 08:46:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=45.118.34.226, lip=66.85.158.91, TLS, session=<yZwMa4VDe9ItdiLi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:46:42 host2 sshd[3491025]: Disconnected from invalid user test1 198.12.114.232 port 47848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.171
country_id: 2635167
description:
Nov 14 08:46:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.171, lip=66.85.158.91, TLS handshaking: Connection closed, session=<StRSbYVDM5W594mr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.163
country_id: 798544
description:
Nov 14 08:46:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.219.105.163, lip=66.85.158.91, TLS, session=<PTDpaYVDpd2y22mj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.164
country_id: 2635167
description:
Nov 14 08:47:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.164, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<wDdOb4VDkau594mk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.155
country_id: 2635167
description:
Nov 14 08:47:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.155, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<A7FJcYVDZ5RX7LCb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.158
country_id: 2635167
description:
Nov 14 08:48:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.158, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VxhDc4VDVaO594me>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.124.122
country_id: 6252001
description:
Nov 14 08:49:03 host2 sshd[3492592]: Disconnected from invalid user user1 158.51.124.122 port 44356 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 121.127.245.132
country_id: 1819730
description:
Denial of Service (DoS) attack was discovered from 121.127.245.132: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.151
country_id: 2635167
description:
Nov 14 08:49:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.151, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3RJ0d4VDBbO594mX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.181
country_id: 2635167
description:
Nov 14 08:48:57 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.181, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<JltAdYVDS6VX7LC1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.166
country_id: 2635167
description:
Nov 14 08:50:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<15BteYVDQ6RX7LCm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:50:16 host2 sshd[3493285]: Disconnected from invalid user wx 198.12.114.232 port 36458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.159
country_id: 2635167
description:
Nov 14 08:50:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.159, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Hfxoe4VDlZJX7LCf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:51:38 host2 sshd[3494042]: Disconnected from invalid user admin 198.12.114.232 port 43858 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 08:55:16 host2 sshd[3496627]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:55:39 host2 sshd[3496794]: Disconnected from invalid user zzl 198.12.114.232 port 49842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 08:56:45 host2 sshd[3497349]: Disconnected from invalid user user 2.57.121.25 port 21543 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:57:09 host2 sshd[3497564]: Disconnected from invalid user krish 198.12.114.232 port 48098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.24
country_id: 1880251
description:
Nov 14 08:59:24 host2 sshd[3499055]: Disconnected from invalid user prowlarr 45.78.207.24 port 57884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.127.38.183
country_id: 3469034
description:
Nov 14 08:59:25 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=189.127.38.183, lip=66.85.158.91, TLS, session=<HUpzmYVDcN29fya3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.63.63
country_id: 3469034
description:
Nov 14 08:59:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=177.85.63.63, lip=66.85.158.91, TLS, session=<aajQmoVDHIWxVT8/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-14 09:01:31 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:45994: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.220.130.169
country_id: 6252001
description:
[2025-11-14 09:03:29 +0530] info [cpaneld] 71.220.130.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.236
country_id: 798544
description:
2025-11-14 09:03:36 dovecot_login authenticator failed for (ADMIN) [138.199.59.236]:52018: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.211.42.208
country_id: 6252001
description:
[2025-11-14 09:03:52 +0530] info [cpaneld] 108.211.42.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.27.63.162
country_id: 6252001
description:
[2025-11-14 09:04:02 +0530] info [whostmgrd] 108.27.63.162 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.255.80.246
country_id: 6252001
description:
[2025-11-14 09:04:08 +0530] info [cpaneld] 64.255.80.246 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.156
country_id: 3017382
description:
Nov 14 09:04:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.156, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YQ2Qq4VDachb51mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.153
country_id: 3017382
description:
Nov 14 09:04:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 13 secs): user=<>, rip=91.231.89.153, lip=66.85.158.91, TLS: Connection closed, session=<AVJerIVDE9Bb51mZ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.225.85
country_id: 6252001
description:
[2025-11-14 09:04:23 +0530] info [cpaneld] 97.170.225.85 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.153
country_id: 1733045
description:
2025-11-14 09:04:23 dovecot_login authenticator failed for ([49.124.154.153]) [49.124.154.153]:60306: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.89.9.190
country_id: 6252001
description:
[2025-11-14 09:04:00 +0530] info [cpaneld] 74.89.9.190 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.133.147.229
country_id: 6252001
description:
[2025-11-14 09:04:21 +0530] info [cpaneld] 72.133.147.229 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.248
country_id: 3017382
description:
Nov 14 09:04:34 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.248, lip=66.85.158.91, TLS: Connection closed, session=<OFQirYVDV5xb51n4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 09:04:54 host2 sshd[3502497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-14 09:04:58 dovecot_login authenticator failed for ([72.239.139.162]) [72.239.139.162]:35082: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:05:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jz/FsIVDCMADjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 09:05:39 host2 sshd[3503125]: Disconnected from invalid user magdalena 62.60.131.157 port 18745 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-14 09:06:36 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57428: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-14 09:06:44 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:48228: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:06:09 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<xr7IsoVDgo0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:07:10 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ypBktoVD/qoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.20
country_id: 6252001
description:
Nov 14 09:07:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.195.20, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Jgtht4VD3O0UQcMU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.207.24
country_id: 1880251
description:
Nov 14 09:08:59 host2 sshd[3505373]: Disconnected from invalid user nguyen 45.78.207.24 port 40622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-14 09:09:18 dovecot_plain authenticator failed for (overs) [65.20.129.67]:48548: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:09:25 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<F9J5voVDEo8DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:09:55 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<7QhAwIVDfuoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:11:05 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QAVyxIVDVMgDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.24
country_id: 1880251
description:
Nov 14 09:11:28 host2 sshd[3506920]: Disconnected from invalid user petra 45.78.207.24 port 42554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:11:57 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vZOKx4VDWL8DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-11-14 09:12:31 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (poseeler) [71.230.228.16]:58770: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:13:01 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<XAVey4VD6uADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.202.233
country_id: 6251999
description:
Nov 14 09:18:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=128.203.202.233, lip=66.85.158.91, TLS, session=<rr0x4IVDAraAy8rp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.137.39
country_id: 2510769
description:
Nov 14 09:19:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.214.137.39, lip=66.85.158.91, TLS, session=<0Syb4oVDXaW51okn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.0.142.98
country_id: 3865483
description:
Nov 14 09:20:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=186.0.142.98, lip=66.85.158.91, TLS, session=<W0LA44VDT7+6AI5i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.240.205.57
country_id: 6252001
description:
2025-11-14 09:23:56 dovecot_login authenticator failed for (ADMIN) [151.240.205.57]:35240: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.135
country_id: 6252001
description:
Nov 14 09:35:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.135, lip=66.85.158.91, session=<9XeyGoZDXvyTuYSH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:35:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<fl1mHYZDqt4DhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 09:37:09 host2 sshd[3524239]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:37:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Qz8sIYZDUtIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:37:57 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<CjiJJIZDuLgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:39:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<H0ElKoZDcosDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:40:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8UvTLIZDsIkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:40:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Gn1HL4ZDGrUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:43:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<d5pcN4ZDcKUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.26
country_id: 798549
description:
2025-11-14 09:52:08 dovecot_login authenticator failed for (ADMIN) [143.244.54.26]:58520: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-11-14 09:55:25 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:56718: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-14 09:55:50 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:40696: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-14 09:55:01 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:52326: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-11-14 09:55:11 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:43743: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 09:57:52 host2 sshd[3544823]: Disconnected from invalid user admin 2.57.121.112 port 61687 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 09:58:42 host2 sshd[3545475]: Disconnected from invalid user admin 2.57.121.112 port 53805 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.88.114.188
country_id: 798544
description:
Nov 14 10:05:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=195.88.114.188, lip=66.85.158.91, TLS, session=<CsIrh4ZDEbXDWHK8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.27.168
country_id: 6252001
description:
Nov 14 10:06:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.27.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<xBhDiYZDjp4UUxuo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.35.28
country_id: 953987
description:
Nov 14 10:06:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.64.35.28, lip=66.85.158.91, TLS, session=<bKVTiIZDXtpmQCMc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-14 10:06:25 dovecot_login authenticator failed for (qf7Erk18b6) [141.98.11.48]:61015: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-14 10:06:40 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:47240: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.61
country_id: 6252001
description:
2025-11-14 10:06:55 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:57475: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-14 10:07:04 dovecot_login authenticator failed for (Y477NyvgWp) [141.98.11.48]:52091: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-14 10:10:25 dovecot_login authenticator failed for (FgMQafH8Xv) [141.98.11.48]:60079: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.124.118
country_id: 6252001
description:
Nov 14 10:10:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.76.124.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<obramIZDZqsoTHx2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:16:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1yEhr4ZDdroDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:17:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<e6HisIZD/OgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:18:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<gaJ4tIZDUqgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:19:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<JBJQuIZD7uQDhpQ7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 10:19:24 host2 pure-ftpd[3565140]: (?@217.119.139.27) [INFO] New connection from 217.119.139.27


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.77
country_id: 3175395
description:
Nov 14 10:20:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.208.188.77, lip=66.85.158.91, TLS, session=<QbWuu4ZD98e50LxN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:20:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<L+hOvYZDiowDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.218.239.163
country_id: 719819
description:
Nov 14 10:20:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.218.239.163, lip=66.85.158.91, TLS, session=<ihqjuoZD24Ml2u+j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:21:14 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DkBHv4ZD4JkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:22:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<ysbyw4ZDVOYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.62
country_id: 2661886
description:
2025-11-14 10:30:23 dovecot_login authenticator failed for (ADMIN) [46.246.8.62]:3910: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.172.146
country_id: 6252001
description:
Nov 14 10:35:18 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.172.146, lip=66.85.158.92, session=<utOj8YZDbsUofKyS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.49
country_id: 6252001
description:
Nov 14 10:35:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.49, lip=66.85.158.91, session=<wdyh8oZDLLsUQcMx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 10:38:39 host2 sshd[3582806]: Disconnected from invalid user user 2.57.121.25 port 20665 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.80
country_id: 6251999
description:
2025-11-14 10:47:04 dovecot_login authenticator failed for (ADMIN) [140.228.21.80]:37373: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.67.18
country_id: 1643084
description:
2025-11-14 10:50:20 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.18]:64276: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.109
country_id: 1269750
description:
2025-11-14 10:50:40 dovecot_login authenticator failed for ([202.140.38.109]) [202.140.38.109]:40510: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.76.140
country_id: 6252001
description:
Nov 14 10:52:12 host2 sshd[3595493]: Disconnected from invalid user backupuser 104.168.76.140 port 55762 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.148
country_id: 6252001
description:
Nov 14 10:52:43 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.148, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Sh7mL4dDh9fG6xiU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.101
country_id: 690791
description:
Nov 14 10:57:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=176.103.7.101, lip=66.85.158.91, TLS, session=<BekmPodD4e2wZwdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.76.140
country_id: 6252001
description:
Nov 14 10:57:14 host2 sshd[3599147]: Disconnected from invalid user headscale 104.168.76.140 port 41328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.37
country_id: 933860
description:
Nov 14 10:57:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=41.216.213.37, lip=66.85.158.91, TLS, session=<5nBYP4dDPOUp2NUl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.220.113.163
country_id: 130758
description:
Nov 14 11:02:56 host2 sshd[3602450]: Disconnected from invalid user cps 91.220.113.163 port 37684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.76.140
country_id: 6252001
description:
Nov 14 11:03:57 host2 sshd[3603217]: Disconnected from invalid user chat 104.168.76.140 port 44374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 14 11:08:36 host2 sshd[3605617]: Disconnected from invalid user noc 150.5.129.10 port 53720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.158
country_id: 2782113
description:
2025-11-14 11:09:19 dovecot_login authenticator failed for (ADMIN) [156.146.60.158]:43889: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.76.140
country_id: 6252001
description:
Nov 14 11:09:25 host2 sshd[3606264]: Disconnected from invalid user nick 104.168.76.140 port 43774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.220.113.163
country_id: 130758
description:
Nov 14 11:09:14 host2 sshd[3606174]: Disconnected from invalid user age 91.220.113.163 port 38122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-14 11:10:14 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:50614: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.220.113.163
country_id: 130758
description:
Nov 14 11:10:28 host2 sshd[3607055]: Disconnected from invalid user blog 91.220.113.163 port 38236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-14 11:10:39 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:52182: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 14 11:13:21 host2 sshd[3608854]: Disconnected from invalid user matin 150.5.129.10 port 36682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 11:14:21 host2 sshd[3609519]: Disconnected from invalid user admin 2.57.121.112 port 41699 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.172.131
country_id: 2658434
description:
Nov 14 11:14:31 host2 pure-ftpd[3609674]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.172.131
country_id: 2658434
description:
Nov 14 11:14:36 host2 pure-ftpd[3609747]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.185.231
country_id: 290557
description:
2025-11-14 11:16:59 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:33859: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-11-14 11:17:11 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:45701: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 11:22:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63947: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.189
country_id: 2510769
description:
2025-11-14 11:28:23 dovecot_login authenticator failed for (ADMIN) [212.102.49.189]:43220: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-14 11:32:15 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:39684: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 14 11:32:37 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.92, session=<7YqdvodDLI4z3piW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov 14 11:36:47 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.92, session=<dCmDzYdDrpRo7NEL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Nov 14 11:37:45 host2 sshd[3624351]: Disconnected from invalid user cheeki 103.189.89.76 port 34252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Nov 14 11:40:45 host2 sshd[3626012]: Disconnected from invalid user ntuser 103.189.89.76 port 55826 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.164.195.81
country_id: 2510769
description:
Nov 14 11:40:15 host2 sshd[3625785]: Disconnected from invalid user lu 188.164.195.81 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.164.195.81
country_id: 2510769
description:
Nov 14 11:41:27 host2 sshd[3626353]: Disconnected from invalid user alex 188.164.195.81 port 32964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.164.195.81
country_id: 2510769
description:
Nov 14 11:43:40 host2 sshd[3627653]: Disconnected from invalid user admin 188.164.195.81 port 39134 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.89.76
country_id: 1880251
description:
Nov 14 11:48:37 host2 sshd[3631040]: Disconnected from invalid user sdtd 103.189.89.76 port 60890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-14 11:51:05 dovecot_plain authenticator failed for (petiatand) [65.20.250.63]:36839: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-14 11:51:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (renestry) [87.103.126.54]:22847: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 23.180.120.243
country_id: 6252001
description:
Nov 14 11:50:12 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=23.180.120.243, lip=66.85.158.91, session=<Pip0/YdDkOoXtHjz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.180.120.243
country_id: 6252001
description:
Nov 14 11:50:11 host2 pure-ftpd[3632566]: (?@23.180.120.243) [INFO] New connection from 23.180.120.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.165
country_id: 3017382
description:
2025-11-14 11:51:28 dovecot_login authenticator failed for (ADMIN) [156.146.63.165]:7450: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.99.142.36
country_id: 2921044
description:
Nov 14 11:57:46 host2 pure-ftpd[3636852]: (?@167.99.142.36) [INFO] New connection from 167.99.142.36


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.219
country_id: 3469034
description:
Nov 14 11:59:52 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=187.120.73.219, lip=66.85.158.91, TLS, session=<uCoBH4hD3o+7eEnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 207.248.113.76
country_id: 3996063
description:
Nov 14 12:00:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=207.248.113.76, lip=66.85.158.91, TLS, session=<GXgiIIhDaqzP+HFM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.77.72.246
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.77.72.246 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.84.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.84.20 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.78.13
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.187.78.13 - gnetuniversals "GET /login/?login_only=1&user=gnetuniversals&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.40.150
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 136.158.40.150 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.246.120
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 27.125.246.120 - gnetuniversal "GET /login/?login_only=1&user=gnetuniversal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.242.191
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 180.75.242.191 - gnetunive "GET /login/?login_only=1&user=gnetunive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetunive (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.123.24
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.19.123.24 - gnetuniversalscom "GET /login/?login_only=1&user=gnetuniversalscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversalscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.78.245
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.187.78.245 - gnetuniversa "GET /login/?login_only=1&user=gnetuniversa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.112.115.172
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.112.115.172 - gnetunivers "GET /login/?login_only=1&user=gnetunivers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetunivers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.181.18.42
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.181.18.42 - gnetuniver "GET /login/?login_only=1&user=gnetuniver&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniver (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.86.137.22
country_id: 3625428
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 82.86.137.22 - gnetuniv "GET /login/?login_only=1&user=gnetuniv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.200.147
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 171.225.200.147 - gnetun "GET /login/?login_only=1&user=gnetun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.120.175.138
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 146.120.175.138 - gnetu "GET /login/?login_only=1&user=gnetu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.106.127.178
country_id: 783754
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 79.106.127.178 - gnet "GET /login/?login_only=1&user=gnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.244.61.197
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.244.61.197 - gn "GET /login/?login_only=1&user=gn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.174.149.5
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 82.174.149.5 - gnetuni2 "GET /login/?login_only=1&user=gnetuni2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.199.23.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.199.23.10 - gnetuni "GET /login/?login_only=1&user=gnetuni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.255.105.33
country_id: 3932488
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.255.105.33 - gne "GET /login/?login_only=1&user=gne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.148.59.54
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 202.148.59.54 - gnetuni1 "GET /login/?login_only=1&user=gnetuni1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.210.85
country_id: 3175395
description:
Nov 14 12:03:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=94.198.210.85, lip=66.85.158.91, TLS, session=<NmPgK4hD34VextJV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.36.238
country_id: 3175395
description:
Nov 14 12:03:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=178.239.36.238, lip=66.85.158.91, TLS, session=<6MXSKohDONKy7yTu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.68
country_id: 298795
description:
2025-11-14 12:06:53 dovecot_login authenticator failed for (ADMIN) [188.213.34.68]:44560: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.97.188
country_id: 798544
description:
Nov 14 12:09:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=178.219.97.188, lip=66.85.158.91, TLS, session=<Kx/JP4hDSMiy22G8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.47
country_id: 798544
description:
Nov 14 12:08:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=89.231.35.47, lip=66.85.158.91, TLS, session=<AG20PohDdL5Z5yMv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-11-14 12:15:00 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:52666: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-14 12:15:16 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:36475: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.52
country_id: 6252001
description:
Nov 14 12:18:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.52, lip=66.85.158.92, session=</abzYIhDevrG6xg0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.148
country_id: 3469034
description:
Nov 14 12:18:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=187.120.72.148, lip=66.85.158.91, TLS, session=<nRX0YYhDi8y7eEiU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.231.85
country_id: 798544
description:
Nov 14 12:18:53 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=193.43.231.85, lip=66.85.158.91, TLS, session=<yGcbY4hDI4PBK+dV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 14 12:19:41 host2 sshd[3650538]: Disconnected from invalid user copyuser 139.59.64.179 port 50470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 14 12:21:12 host2 sshd[3651410]: Disconnected from invalid user rad 139.59.64.179 port 53752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.17.8.234
country_id: 3175395
description:
Nov 14 12:21:17 host2 sshd[3651469]: Disconnected from invalid user laci 79.17.8.234 port 59732 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.18
country_id: 1605651
description:
Nov 14 12:22:05 host2 pure-ftpd[3651825]: (?@103.176.152.18) [INFO] New connection from 103.176.152.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-14 12:26:29 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:48582: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.78
country_id: 6251999
description:
2025-11-14 12:26:30 dovecot_login authenticator failed for (ADMIN) [66.56.80.78]:46003: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.192
country_id: 6252001
description:
Nov 14 12:26:35 host2 pure-ftpd[3654542]: (?@198.235.24.192) [INFO] New connection from 198.235.24.192


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-11-14 12:26:45 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:43525: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.17.8.234
country_id: 3175395
description:
Nov 14 12:26:20 host2 sshd[3654367]: Disconnected from invalid user dev 79.17.8.234 port 60844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 14 12:27:17 host2 sshd[3654940]: Disconnected from invalid user mahsa 139.59.64.179 port 38158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.17.8.234
country_id: 3175395
description:
Nov 14 12:29:26 host2 sshd[3656096]: Disconnected from invalid user helloworld 79.17.8.234 port 33340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Nov 14 12:38:08 host2 sshd[3661484]: Disconnected from invalid user aaa 103.49.238.104 port 36686 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.42.147
country_id: 690791
description:
Nov 14 12:38:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.239.42.147, lip=66.85.158.91, session=<rg+DqYhDgs9U7yqT>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 77.81.142.139
country_id: 3996063
description:
Nov 14 12:38:18 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (disconnected before auth was ready, waited 0 secs): user=<>, rip=77.81.142.139, lip=66.85.158.91, session=<GeF/qYhDGIZNUY6L>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.239.139
country_id: 1227603
description:
Nov 14 12:38:15 host2 pure-ftpd[3661670]: (?@95.181.239.139) [INFO] New connection from 95.181.239.139


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.238
country_id: 3469034
description:
Nov 14 12:39:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=191.53.128.238, lip=66.85.158.91, TLS, session=<c/tpq4hDTdy/NYDu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.29
country_id: 690791
description:
Nov 14 12:39:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=37.221.131.29, lip=66.85.158.91, TLS, session=<bmGVrIhDB6sl3YMd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.228
country_id: 1880251
description:
Nov 14 12:42:05 host2 sshd[3663755]: Disconnected from invalid user deployer 45.78.198.228 port 38902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Nov 14 12:44:06 host2 sshd[3665263]: Disconnected from invalid user wafer 103.49.238.104 port 56072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.85
country_id: 298795
description:
2025-11-14 12:44:44 dovecot_login authenticator failed for (ADMIN) [188.213.34.85]:47926: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.17.8.234
country_id: 3175395
description:
Nov 14 12:44:14 host2 sshd[3665381]: Disconnected from invalid user nick 79.17.8.234 port 36616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.13.244.133
country_id: 3469034
description:
Nov 14 12:47:17 host2 sshd[3667595]: Disconnected from invalid user deploy 191.13.244.133 port 47482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Nov 14 12:48:34 host2 sshd[3668348]: Disconnected from invalid user ceo 103.49.238.104 port 33502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Nov 14 12:50:09 host2 sshd[3669452]: Disconnected from invalid user staging 103.49.238.104 port 52602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-11-14 12:50:28 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (molie) [71.230.228.16]:33498: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.104
country_id: 1643084
description:
Nov 14 12:51:45 host2 sshd[3670668]: Disconnected from invalid user ubuntu 103.49.238.104 port 48302 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.81.215.240
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.81.215.240 - euroentertainmentlk "GET /login/?login_only=1&user=euroentertainmentlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.247.120.65
country_id: 3686110
description:
[2025-11-14 12:52:24 +0530] info [whostmgrd] 77.247.120.65 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.16.182.195
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 165.16.182.195 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.202.36
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.190.202.36 - euroentertainmentl "GET /login/?login_only=1&user=euroentertainmentl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.184.85.76
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.184.85.76 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.37.158.248
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.37.158.248 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.142.22.255
country_id: 732800
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 217.142.22.255 - euroentertainment "GET /login/?login_only=1&user=euroentertainment&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainment (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.41.103.215
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.41.103.215 - euroentertainme "GET /login/?login_only=1&user=euroentertainme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.78.197.180
country_id: 6252001
description:
[2025-11-14 12:52:57 +0530] info [cpaneld] 72.78.197.180 - euroentertainmen "GET /login/?login_only=1&user=euroentertainmen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.177.138.141
country_id: 3469034
description:
[2025-11-14 12:53:46 +0530] info [cpaneld] 191.177.138.141 - euroe "GET /login/?login_only=1&user=euroe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.122.181.24
country_id: 3865483
description:
[2025-11-14 12:53:33 +0530] info [cpaneld] 190.122.181.24 - euroenter "GET /login/?login_only=1&user=euroenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.212.79.45
country_id: 6252001
description:
[2025-11-14 12:53:44 +0530] info [cpaneld] 72.212.79.45 - euroen "GET /login/?login_only=1&user=euroen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.70.199.72
country_id: 1269750
description:
[2025-11-14 12:53:43 +0530] info [cpaneld] 103.70.199.72 - euroent "GET /login/?login_only=1&user=euroent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.200.201
country_id: 290291
description:
[2025-11-14 12:53:19 +0530] info [cpaneld] 77.69.200.201 - euroentertai "GET /login/?login_only=1&user=euroentertai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.174.69.161
country_id: 1282988
description:
[2025-11-14 12:53:36 +0530] info [cpaneld] 103.174.69.161 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.18.123.70
country_id: 2921044
description:
[2025-11-14 12:53:53 +0530] info [cpaneld] 91.18.123.70 - euro "GET /login/?login_only=1&user=euro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.192.34.165
country_id: 1605651
description:
[2025-11-14 12:54:01 +0530] info [cpaneld] 159.192.34.165 - euroent2 "GET /login/?login_only=1&user=euroent2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.240.243.113
country_id: 1655842
description:
[2025-11-14 12:53:21 +0530] info [cpaneld] 103.240.243.113 - euroenterta "GET /login/?login_only=1&user=euroenterta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenterta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.51.203.139
country_id: 2635167
description:
[2025-11-14 12:53:59 +0530] info [cpaneld] 31.51.203.139 - euroent1 "GET /login/?login_only=1&user=euroent1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.108.89.4
country_id: 2635167
description:
[2025-11-14 12:53:57 +0530] info [cpaneld] 81.108.89.4 - eu "GET /login/?login_only=1&user=eu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.117.12.62
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.117.12.62 - euroentertainm "GET /login/?login_only=1&user=euroentertainm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 59.178.69.223
country_id: 1269750
description:
[2025-11-14 12:53:16 +0530] info [cpaneld] 59.178.69.223 - euroentertain "GET /login/?login_only=1&user=euroentertain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.82.201.3
country_id: 3865483
description:
[2025-11-14 12:53:29 +0530] info [cpaneld] 191.82.201.3 - euroentert "GET /login/?login_only=1&user=euroentert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.66.107.88
country_id: 3351879
description:
[2025-11-14 12:53:55 +0530] info [cpaneld] 154.66.107.88 - eur "GET /login/?login_only=1&user=eur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eur (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.13.244.133
country_id: 3469034
description:
Nov 14 12:55:04 host2 sshd[3673257]: Disconnected from invalid user ubuntu 191.13.244.133 port 54248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-14 12:56:26 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (anozer) [24.127.53.61]:43860: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.131.110.205
country_id: 290291
description:
[2025-11-14 13:00:07 +0530] info [whostmgrd] 37.131.110.205 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.100.248.118
country_id: 2542007
description:
[2025-11-14 13:00:09 +0530] info [cpaneld] 102.100.248.118 - simpuritylk "GET /login/?login_only=1&user=simpuritylk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpuritylk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.185.63
country_id: 6252001
description:
[2025-11-14 12:59:54 +0530] info [cpaneld] 73.151.185.63 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.246.205
country_id: 6252001
description:
[2025-11-14 12:59:55 +0530] info [cpaneld] 73.93.246.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.130.9.250
country_id: 6252001
description:
[2025-11-14 12:59:56 +0530] info [cpaneld] 69.130.9.250 - simpurity "GET /login/?login_only=1&user=simpurity&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpurity (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.174.55.210
country_id: 3017382
description:
[2025-11-14 13:00:29 +0530] info [cpaneld] 91.174.55.210 - simp "GET /login/?login_only=1&user=simp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.69.59.249
country_id: 2215636
description:
[2025-11-14 13:00:36 +0530] info [cpaneld] 102.69.59.249 - sim "GET /login/?login_only=1&user=sim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.51.151.96
country_id: 2017370
description:
[2025-11-14 13:00:38 +0530] info [cpaneld] 77.51.151.96 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.42.186.29
country_id: 3175395
description:
[2025-11-14 13:00:11 +0530] info [cpaneld] 79.42.186.29 - simpurit "GET /login/?login_only=1&user=simpurit&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.17.144.120
country_id: 2635167
description:
[2025-11-14 13:00:18 +0530] info [cpaneld] 86.17.144.120 - simpuri "GET /login/?login_only=1&user=simpuri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpuri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.116.21.52
country_id: 3895114
description:
[2025-11-14 13:00:20 +0530] info [cpaneld] 191.116.21.52 - simpur "GET /login/?login_only=1&user=simpur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.87.109.128
country_id: 102358
description:
[2025-11-14 13:00:22 +0530] info [cpaneld] 178.87.109.128 - simpu "GET /login/?login_only=1&user=simpu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpu (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.233.24.129
country_id: 2802361
description:
Nov 14 13:02:35 host2 pure-ftpd[3678027]: (?@35.233.24.129) [INFO] New connection from 35.233.24.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.81
country_id: 6252001
description:
2025-11-14 13:04:48 dovecot_login authenticator failed for (ADMIN) [158.173.153.81]:29523: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.13.244.133
country_id: 3469034
description:
Nov 14 13:06:20 host2 sshd[3680968]: Disconnected from invalid user charan 191.13.244.133 port 36476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-14 13:07:18 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:44067: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2025-11-14 13:07:32 dovecot_login authenticator failed for (host-129.0.111.246.mtn.cm) [129.0.111.246]:59256: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.13.244.133
country_id: 3469034
description:
Nov 14 13:09:39 host2 sshd[3682656]: Disconnected from invalid user erp 191.13.244.133 port 33124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.13.244.133
country_id: 3469034
description:
Nov 14 13:11:57 host2 sshd[3684030]: Disconnected from invalid user mariadb 191.13.244.133 port 36830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 14 13:17:04 host2 sshd[3686619]: Disconnected from invalid user access 94.254.0.234 port 44328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-14 13:17:58 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:42256: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-14 13:17:36 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:43674: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 14 13:19:23 host2 sshd[3687749]: Disconnected from invalid user gl 94.254.0.234 port 48060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 14 13:24:54 host2 sshd[3691211]: Disconnected from invalid user redmine 94.254.0.234 port 43118 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.145.63.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.145.63.75 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.36.44.162
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.36.44.162 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.8
country_id: 102358
description:
2025-11-14 13:24:44 dovecot_login authenticator failed for (ADMIN) [95.181.235.8]:53499: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.189.61.255
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.189.61.255 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.86.52.108
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.86.52.108 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.144.246
country_id: 587116
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.114.144.246 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.68
country_id: 298795
description:
Nov 14 13:25:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=45.67.155.68, lip=66.85.158.91, TLS, session=<maAKUIlDcaYtQ5tE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.86.113.196
country_id: 390903
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2.86.113.196 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.47
country_id: 3469034
description:
Nov 14 13:25:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=177.92.247.47, lip=66.85.158.91, TLS, session=<0CFCUYlDr+WxXPcv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.83.114.253
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.83.114.253 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.25.184.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.25.184.21 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.255.51.130
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 151.255.51.130 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.189.228
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.164.189.228 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.5
country_id: 6252001
description:
Nov 14 13:28:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.92, TLS: Connection closed, session=<WMIRXIlDeprCpGsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.251
country_id: 953987
description:
Nov 14 13:29:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.64.32.251, lip=66.85.158.91, TLS, session=<pRcMYYlDCL9mQCD7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.3
country_id: 6252001
description:
Nov 14 13:30:49 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=66.85.158.91, TLS, session=<umhHZYlDFqnLN4MD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.170
country_id: 3469034
description:
Nov 14 13:30:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=177.44.96.170, lip=66.85.158.91, TLS, session=<YXtNYolDE9OxLGCq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.75
country_id: 6252001
description:
Nov 14 13:32:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.75, lip=66.85.158.92, TLS, session=<pELnbIlDUvmTuYRL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.67
country_id: 6252001
description:
Nov 14 13:33:56 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.67, lip=66.85.158.91, session=<O4J3cIlDG9vDuExD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.175
country_id: 6252001
description:
Nov 14 13:34:06 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.175, lip=66.85.158.91, session=<lUYScYlDManDuEyv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.68
country_id: 6252001
description:
Nov 14 13:34:16 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.68, lip=66.85.158.91, session=<LAWjcYlDKc/DuExE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.171
country_id: 6252001
description:
Nov 14 13:34:13 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.171, lip=66.85.158.91, session=<RftycYlDVdTDuEyr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.149
country_id: 2635167
description:
Nov 14 13:38:05 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.149, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<yQZOf4lDS7hX7LCV>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.172.200.103
country_id: 3351879
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.172.200.103 - lakwelholdings "GET /login/?login_only=1&user=lakwelholdings&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.97
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.60.66.97 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-14 13:37:23 dovecot_plain authenticator failed for (catisfacet) [103.174.34.49]:50192: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.190
country_id: 2635167
description:
Nov 14 13:38:04 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.190, lip=66.85.158.91, TLS, session=<DQY+f4lD259X7LC+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.101.0.242
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.101.0.242 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-14 13:38:07 dovecot_plain authenticator failed for (micoms) [94.204.236.202]:51785: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.11.59.190
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.11.59.190 - lakwelhold "GET /login/?login_only=1&user=lakwelhold&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelhold (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.103.13.110
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.103.13.110 - lakwelho "GET /login/?login_only=1&user=lakwelho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.218.206.136
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.218.206.136 - lakwelholdin "GET /login/?login_only=1&user=lakwelholdin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelholdin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.78.2.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.78.2.31 - lakwelholdi "GET /login/?login_only=1&user=lakwelholdi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelholdi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.176
country_id: 2635167
description:
Nov 14 13:38:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.176, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rmVJgYlDO+dX7LCw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.211.206.187
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.211.206.187 - lakwelholding "GET /login/?login_only=1&user=lakwelholding&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelholding (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.182.164.186
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.182.164.186 - lakwelhol "GET /login/?login_only=1&user=lakwelhol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelhol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.80.64.30
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 191.80.64.30 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.253.148.128
country_id: 3932488
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.253.148.128 - lakwelholdingscom "GET /login/?login_only=1&user=lakwelholdingscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.177.114.14
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.177.114.14 - lakwelh "GET /login/?login_only=1&user=lakwelh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.172.124.98
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.172.124.98 - lakwe "GET /login/?login_only=1&user=lakwe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.222.215.7
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 106.222.215.7 - lakw "GET /login/?login_only=1&user=lakw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.87.28.167
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.87.28.167 - lakwelh1 "GET /login/?login_only=1&user=lakwelh1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelh1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.205.151.233
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.205.151.233 - lakwelh2 "GET /login/?login_only=1&user=lakwelh2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwelh2 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.170
country_id: 2635167
description:
Nov 14 13:39:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.170, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<FBBGg4lD15JX7LCq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.250.31.2
country_id: 2661886
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 83.250.31.2 - lakwel "GET /login/?login_only=1&user=lakwel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lakwel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.227.75.79
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.227.75.79 - lak "GET /login/?login_only=1&user=lak&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lak (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.172
country_id: 2635167
description:
Nov 14 13:39:45 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.172, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<WppBhYlDn6RX7LCs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.168
country_id: 2635167
description:
Nov 14 13:40:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.168, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9vY8h4lDl8y594mo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.158
country_id: 2635167
description:
Nov 14 13:40:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.158, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZBA3iYlDa76594me>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.150
country_id: 2635167
description:
Nov 14 13:41:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.150, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<1As1i4lDUbBX7LCW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.171
country_id: 2635167
description:
Nov 14 13:41:58 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.171, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<mLoxjYlDzY+594mr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.181
country_id: 2635167
description:
Nov 14 13:42:31 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.181, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Vakrj4lDMde594m1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.167
country_id: 2635167
description:
Nov 14 13:43:05 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.167, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<+KcnkYlD54JX7LCn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 13:45:25 host2 sshd[3703439]: Disconnected from invalid user admin 2.57.121.112 port 43437 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.20
country_id: 798549
description:
2025-11-14 13:47:09 dovecot_login authenticator failed for (ADMIN) [143.244.54.20]:49238: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.213
country_id: 298795
description:
Nov 14 13:50:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=45.67.155.213, lip=66.85.158.91, TLS, session=<zYjGqIlDBK0tQ5vV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.173.5
country_id: 798544
description:
Nov 14 13:50:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=91.236.173.5, lip=66.85.158.91, TLS, session=<i0UaqolDOtdb7K0F>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 14:00:57 host2 sshd[3715504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.143
country_id: 6252001
description:
Nov 14 14:06:27 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.143, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<RffB5IlDe8XN0h+P>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.39.204.143
country_id: 285570
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 37.39.204.143 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.71
country_id: 783754
description:
2025-11-14 14:06:46 dovecot_login authenticator failed for (ADMIN) [31.171.154.71]:35254: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.200.80
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 196.115.200.80 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.21.170.75
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 87.21.170.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.37.24.240
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.37.24.240 - askinternationalconsortium "GET /login/?login_only=1&user=askinternationalconsortium&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalconsortium (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.71.25.73
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.71.25.73 - askinternationalcon "GET /login/?login_only=1&user=askinternationalcon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalcon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.182.105.181
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 93.182.105.181 - askinternationalco "GET /login/?login_only=1&user=askinternationalco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.223.9.9
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.223.9.9 - askinternationalco "GET /login/?login_only=1&user=askinternationalco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.28.86.46
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.28.86.46 - askinternationalc "GET /login/?login_only=1&user=askinternationalc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.225.10.116
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.225.10.116 - askinternationalcons "GET /login/?login_only=1&user=askinternationalcons&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalcons (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.66.125.247
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.66.125.247 - askinternationalconsortiumcom "GET /login/?login_only=1&user=askinternationalconsortiumcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationalconsortiumcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.10.179.72
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.10.179.72 - askinternational "GET /login/?login_only=1&user=askinternational&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.101.137.160
country_id: 289688
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.101.137.160 - askinternat "GET /login/?login_only=1&user=askinternat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternat (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.109.68
country_id: 1062947
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 129.222.109.68 - aski "GET /login/?login_only=1&user=aski&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aski (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.57.154.41
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.57.154.41 - askinter "GET /login/?login_only=1&user=askinter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.250.75.87
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.250.75.87 - as "GET /login/?login_only=1&user=as&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user as (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.232.175.152
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.232.175.152 - askinte "GET /login/?login_only=1&user=askinte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.73.70.169
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.73.70.169 - askin "GET /login/?login_only=1&user=askin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.2.188.157
country_id: 1227603
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 101.2.188.157 - ask "GET /login/?login_only=1&user=ask&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ask (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.0.210.202
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 167.0.210.202 - askinternationa "GET /login/?login_only=1&user=askinternationa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternationa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.122.89.250
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.122.89.250 - askinternation "GET /login/?login_only=1&user=askinternation&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternation (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.227.183
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 51.36.227.183 - askinternati "GET /login/?login_only=1&user=askinternati&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternati (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.25.145.191
country_id: 2562770
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 77.25.145.191 - askintern "GET /login/?login_only=1&user=askintern&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askintern (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.250.3.250
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.250.3.250 - askint "GET /login/?login_only=1&user=askint&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askint (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.108.239.253
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.108.239.253 - askinternatio "GET /login/?login_only=1&user=askinternatio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinternatio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.49.39.205
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.49.39.205 - askinterna "GET /login/?login_only=1&user=askinterna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinterna (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.36.146.229
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 100.36.146.229 - askinte1 "GET /login/?login_only=1&user=askinte1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.37.33.184
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.37.33.184 - askinte2 "GET /login/?login_only=1&user=askinte2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user askinte2 (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 14:19:16 host2 sshd[3729386]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-14 14:19:03 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:49199: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.23.53.80
country_id: 6252001
description:
2025-11-14 14:19:24 dovecot_login authenticator failed for ([38.23.53.80]) [38.23.53.80]:51982: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 14:24:26 host2 sshd[3732802]: Disconnected from invalid user admin 2.57.121.112 port 58592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 14 14:27:33 host2 sshd[3736017]: Disconnected from invalid user consulta 198.23.143.193 port 46060 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-11-14 14:28:17 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (cames) [24.91.103.202]:57436: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-14 14:28:20 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (efearhad) [68.60.77.128]:53228: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.122.63.227
country_id: 3469034
description:
[2025-11-14 14:29:18 +0530] info [cpaneld] 187.122.63.227 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.228.78.250
country_id: 3469034
description:
[2025-11-14 14:29:20 +0530] info [cpaneld] 186.228.78.250 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.108.135.61
country_id: 6251999
description:
[2025-11-14 14:29:26 +0530] info [cpaneld] 24.108.135.61 - dandagamuwa "GET /login/?login_only=1&user=dandagamuwa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuwa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.108.52.197
country_id: 3469034
description:
[2025-11-14 14:29:33 +0530] info [whostmgrd] 179.108.52.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.115.168.80
country_id: 3469034
description:
[2025-11-14 14:29:59 +0530] info [cpaneld] 189.115.168.80 - dandaga "GET /login/?login_only=1&user=dandaga&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.145.124
country_id: 3865483
description:
[2025-11-14 14:29:35 +0530] info [cpaneld] 186.158.145.124 - dandagamuwalk "GET /login/?login_only=1&user=dandagamuwalk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuwalk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.58.144.1
country_id: 3996063
description:
[2025-11-14 14:29:47 +0530] info [cpaneld] 38.58.144.1 - dandagamuw "GET /login/?login_only=1&user=dandagamuw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamuw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.252.84.36
country_id: 1643084
description:
[2025-11-14 14:30:09 +0530] info [cpaneld] 180.252.84.36 - danda "GET /login/?login_only=1&user=danda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user danda (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.64.94
country_id: 3895114
description:
[2025-11-14 14:30:18 +0530] info [cpaneld] 179.60.64.94 - dandaga1 "GET /login/?login_only=1&user=dandaga1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.63.147.235
country_id: 3469034
description:
[2025-11-14 14:30:13 +0530] info [cpaneld] 187.63.147.235 - dan "GET /login/?login_only=1&user=dan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.159.17.42
country_id: 3686110
description:
[2025-11-14 14:30:19 +0530] info [cpaneld] 186.159.17.42 - dandaga2 "GET /login/?login_only=1&user=dandaga2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandaga2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.7.28
country_id: 6252001
description:
[2025-11-14 14:29:48 +0530] info [cpaneld] 23.243.7.28 - dandagamu "GET /login/?login_only=1&user=dandagamu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandagamu (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 14 14:29:54 host2 sshd[3738353]: Disconnected from invalid user appuser 198.23.143.193 port 57240 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.25.228.167
country_id: 2464461
description:
[2025-11-14 14:29:57 +0530] info [cpaneld] 197.25.228.167 - dandagam "GET /login/?login_only=1&user=dandagam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.70.28
country_id: 3469034
description:
[2025-11-14 14:30:07 +0530] info [cpaneld] 170.83.70.28 - dandag "GET /login/?login_only=1&user=dandag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dandag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.236.1.18
country_id: 3996063
description:
[2025-11-14 14:30:10 +0530] info [cpaneld] 177.236.1.18 - dand "GET /login/?login_only=1&user=dand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.209.221.4
country_id: 2287781
description:
[2025-11-14 14:30:15 +0530] info [cpaneld] 102.209.221.4 - da "GET /login/?login_only=1&user=da&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user da (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.202.228.67
country_id: 1694008
description:
[2025-11-14 14:31:22 +0530] info [cpaneld] 112.202.228.67 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.37.95.167
country_id: 3469034
description:
[2025-11-14 14:32:18 +0530] info [cpaneld] 177.37.95.167 - visionsolutionshospi "GET /login/?login_only=1&user=visionsolutionshospi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.109.11
country_id: 3469034
description:
[2025-11-14 14:32:30 +0530] info [cpaneld] 45.190.109.11 - visionsolutionshosp "GET /login/?login_only=1&user=visionsolutionshosp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshosp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.94.67.138
country_id: 3469034
description:
[2025-11-14 14:31:44 +0530] info [cpaneld] 179.94.67.138 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.245.116.235
country_id: 6252001
description:
[2025-11-14 14:32:01 +0530] info [cpaneld] 73.245.116.235 - visionsolutionshospital "GET /login/?login_only=1&user=visionsolutionshospital&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospital (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.57.252.163
country_id: 3865483
description:
[2025-11-14 14:32:08 +0530] info [whostmgrd] 186.57.252.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.204.144.15
country_id: 1269750
description:
[2025-11-14 14:32:15 +0530] info [cpaneld] 49.204.144.15 - visionsolutionshospitalcom "GET /login/?login_only=1&user=visionsolutionshospitalcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshospitalcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.87.59
country_id: 1512440
description:
[2025-11-14 14:33:07 +0530] info [cpaneld] 213.230.87.59 - visionsolutio "GET /login/?login_only=1&user=visionsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.47.132.15
country_id: 1643084
description:
[2025-11-14 14:33:09 +0530] info [cpaneld] 103.47.132.15 - visionsoluti "GET /login/?login_only=1&user=visionsoluti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsoluti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.100.247.195
country_id: 102358
description:
[2025-11-14 14:33:17 +0530] info [cpaneld] 167.100.247.195 - visionsolut "GET /login/?login_only=1&user=visionsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.171
country_id: 3865483
description:
[2025-11-14 14:33:24 +0530] info [cpaneld] 181.46.164.171 - visionsolu "GET /login/?login_only=1&user=visionsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.107.172.13
country_id: 3895114
description:
[2025-11-14 14:32:37 +0530] info [cpaneld] 186.107.172.13 - visionsolutionshos "GET /login/?login_only=1&user=visionsolutionshos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionshos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.100.160
country_id: 6252001
description:
[2025-11-14 14:32:44 +0530] info [cpaneld] 35.151.100.160 - visionsolutionsh "GET /login/?login_only=1&user=visionsolutionsh&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.88.76
country_id: 99237
description:
[2025-11-14 14:32:52 +0530] info [cpaneld] 169.224.88.76 - visionsolutions "GET /login/?login_only=1&user=visionsolutions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.25.134.70
country_id: 3439705
description:
[2025-11-14 14:33:33 +0530] info [cpaneld] 179.25.134.70 - visionso "GET /login/?login_only=1&user=visionso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.18.98.245
country_id: 6252001
description:
[2025-11-14 14:32:43 +0530] info [cpaneld] 73.18.98.245 - visionsolutionsho "GET /login/?login_only=1&user=visionsolutionsho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolutionsho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.237.34.120
country_id: 3277605
description:
[2025-11-14 14:32:59 +0530] info [cpaneld] 109.237.34.120 - visionsolution "GET /login/?login_only=1&user=visionsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsolution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.143.12
country_id: 3469034
description:
[2025-11-14 14:33:26 +0530] info [cpaneld] 179.60.143.12 - visionsol "GET /login/?login_only=1&user=visionsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visionsol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.153
country_id: 1694008
description:
2025-11-14 14:33:37 dovecot_login authenticator failed for (ADMIN) [188.214.125.153]:58078: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.115.176.75
country_id: 6252001
description:
[2025-11-14 14:34:16 +0530] info [cpaneld] 158.115.176.75 - vi "GET /login/?login_only=1&user=vi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.82.41.19
country_id: 6252001
description:
[2025-11-14 14:33:44 +0530] info [cpaneld] 71.82.41.19 - visions "GET /login/?login_only=1&user=visions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.192.239.195
country_id: 1269750
description:
[2025-11-14 14:34:02 +0530] info [cpaneld] 203.192.239.195 - vision "GET /login/?login_only=1&user=vision&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vision (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.91.218.245
country_id: 953987
description:
[2025-11-14 14:34:05 +0530] info [cpaneld] 197.91.218.245 - visio "GET /login/?login_only=1&user=visio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.124.142.126
country_id: 3865483
description:
[2025-11-14 14:34:12 +0530] info [cpaneld] 190.124.142.126 - visi "GET /login/?login_only=1&user=visi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.222.218.122
country_id: 1269750
description:
[2025-11-14 14:34:15 +0530] info [cpaneld] 106.222.218.122 - vis "GET /login/?login_only=1&user=vis&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vis (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.18.153.28
country_id: 2017370
description:
[2025-11-14 14:34:18 +0530] info [cpaneld] 81.18.153.28 - visions1 "GET /login/?login_only=1&user=visions1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.81.128.239
country_id: 1835841
description:
[2025-11-14 14:34:35 +0530] info [cpaneld] 180.81.128.239 - visions2 "GET /login/?login_only=1&user=visions2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user visions2 (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 14 14:34:40 host2 sshd[3742200]: Disconnected from invalid user hadi 198.23.143.193 port 56608 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.226.33.124
country_id: 3865483
description:
Nov 14 14:38:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.226.33.124, lip=66.85.158.91, TLS, session=<nO1tV4pDCOG+4iF8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.153.240
country_id: 690791
description:
Nov 14 14:39:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=37.221.153.240, lip=66.85.158.91, TLS, session=<2MWyWIpD2ogl3Znw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 14 14:41:41 host2 sshd[3747288]: Disconnected from invalid user gituser 198.23.143.193 port 55656 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.29
country_id: 1819730
description:
Nov 14 14:46:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.29, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<odiCc4pD8nQtjpod>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.94
country_id: 1819730
description:
Nov 14 14:47:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.94, lip=66.85.158.91, TLS, session=<ohFgd4pDzuYtjppe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.45
country_id: 2802361
description:
2025-11-14 14:50:00 dovecot_login authenticator failed for (ADMIN) [181.214.218.45]:52007: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 15:00:34 host2 sshd[3761362]: Disconnected from invalid user admin 2.57.121.112 port 31293 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.125
country_id: 3469034
description:
Nov 14 15:02:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=191.37.11.125, lip=66.85.158.91, TLS, session=<E1xdrIpDZdy/JQt9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.170
country_id: 226074
description:
Nov 14 15:02:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=196.0.107.170, lip=66.85.158.91, TLS, session=<JH+0rYpDtJXEAGuq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 15:06:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49579: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-11-14 15:08:52 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:64368: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.110.3
country_id: 798544
description:
Nov 14 15:08:56 host2 sshd[3766635]: Disconnected from invalid user bitrix 83.168.110.3 port 47772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-14 15:08:58 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:56058: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-14 15:09:09 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:45130: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.215
country_id: 6252001
description:
Nov 14 15:09:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.215, lip=66.85.158.92, TLS, session=<oxLCx4pD7ujN0h/X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.77
country_id: 6252001
description:
Nov 14 15:11:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.155.77, lip=66.85.158.91, TLS: Connection closed, session=</3CdzIpDlN7HLZtN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.77
country_id: 6252001
description:
Nov 14 15:11:22 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=199.45.155.77, lip=66.85.158.91, session=</LvtzIpDcMjHLZtN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.118
country_id: 6252001
description:
2025-11-14 15:11:47 dovecot_login authenticator failed for (ADMIN) [212.32.49.118]:23391: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.110.3
country_id: 798544
description:
Nov 14 15:12:41 host2 sshd[3768832]: Disconnected from invalid user admin1 83.168.110.3 port 54324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.110.3
country_id: 798544
description:
Nov 14 15:16:15 host2 sshd[3771180]: Disconnected from invalid user smb 83.168.110.3 port 59832 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.63.56.43
country_id: 290291
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.63.56.43 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.161.211.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.161.211.188 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.19.35.145
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.19.35.145 - simpleengi "GET /login/?login_only=1&user=simpleengi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.17.187.89
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.17.187.89 - simpleengineeringlk "GET /login/?login_only=1&user=simpleengineeringlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineeringlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.135.222.251
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 139.135.222.251 - simpleengineerin "GET /login/?login_only=1&user=simpleengineerin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.119.255.223
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.119.255.223 - simpleengineeri "GET /login/?login_only=1&user=simpleengineeri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineeri (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.70.161.111
country_id: 390903
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 94.70.161.111 - simpleengineer "GET /login/?login_only=1&user=simpleengineer&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineer (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.207.152.144
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 196.207.152.144 - simpleenginee "GET /login/?login_only=1&user=simpleenginee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleenginee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.163.207.123
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.163.207.123 - simpleengin "GET /login/?login_only=1&user=simpleengin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.97.164.160
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.97.164.160 - simpleeng "GET /login/?login_only=1&user=simpleeng&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleeng (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.86.110.210
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.86.110.210 - simpleengineering "GET /login/?login_only=1&user=simpleengineering&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengineering (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.47.142.112
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 49.47.142.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.74.200.252
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.74.200.252 - simpleengine "GET /login/?login_only=1&user=simpleengine&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpleengine (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.77.141.185
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 106.77.141.185 - simplee2 "GET /login/?login_only=1&user=simplee2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.153.241.70
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.153.241.70 - simplee "GET /login/?login_only=1&user=simplee&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.250.228.181
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 130.250.228.181 - simple "GET /login/?login_only=1&user=simple&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simple (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.33.6
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.164.33.6 - simp "GET /login/?login_only=1&user=simp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.7.229
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.7.229 - sim "GET /login/?login_only=1&user=sim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sim (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.88.147.243
country_id: 1522867
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 81.88.147.243 - si "GET /login/?login_only=1&user=si&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user si (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.0.179.158
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.0.179.158 - simplee1 "GET /login/?login_only=1&user=simplee1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simplee1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.6.120.70
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.6.120.70 - simpl "GET /login/?login_only=1&user=simpl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user simpl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 15:23:31 host2 sshd[3774933]: Disconnected from invalid user  2.57.121.112 port 61233 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
country_id: 6252001
description:
2025-11-14 15:24:23 dovecot_login authenticator failed for ([162.186.17.150]) [162.186.17.150]:40350: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-11-14 15:24:39 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:38170: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.53
country_id: 6252001
description:
2025-11-14 15:29:37 dovecot_login authenticator failed for (ADMIN) [95.181.238.53]:55448: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.209.101.132
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.209.101.132 - anandaob "GET /login/?login_only=1&user=anandaob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.200.141.212
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 87.200.141.212 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.129.183.86
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.129.183.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.135.96.241
country_id: 146669
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 185.135.96.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.67.32.23
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 151.67.32.23 - anandaobauaeorg "GET /login/?login_only=1&user=anandaobauaeorg&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauaeorg (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.88.93.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.88.93.171 - anandaobau "GET /login/?login_only=1&user=anandaobau&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobau (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.128.161.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.128.161.212 - anandao "GET /login/?login_only=1&user=anandao&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.87.68.216
country_id: 1527747
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.87.68.216 - anandaobauae "GET /login/?login_only=1&user=anandaobauae&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobauae (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.179.102.129
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.179.102.129 - anandaobaua "GET /login/?login_only=1&user=anandaobaua&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaobaua (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.181.0.6
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.181.0.6 - anandaoba "GET /login/?login_only=1&user=anandaoba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandaoba (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.93.176
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.81.93.176 - ananda "GET /login/?login_only=1&user=ananda&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ananda (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 15:35:35 host2 sshd[3792319]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 155.93.251.157
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 155.93.251.157 - anand "GET /login/?login_only=1&user=anand&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anand (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.219
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.237.119.219 - anan "GET /login/?login_only=1&user=anan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.189.151.248
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.189.151.248 - anandao1 "GET /login/?login_only=1&user=anandao1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.149
country_id: 1694008
description:
2025-11-14 15:35:37 dovecot_login authenticator failed for ([124.105.219.170]) [124.105.218.149]:43918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.135.169.197
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.135.169.197 - ana "GET /login/?login_only=1&user=ana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.250.252.136
country_id: 3437598
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.250.252.136 - an "GET /login/?login_only=1&user=an&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user an (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.78.20.133
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.78.20.133 - anandao2 "GET /login/?login_only=1&user=anandao2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user anandao2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-14 15:36:25 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:53716: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 15:37:06 host2 sshd[3796374]: Disconnected from invalid user user 2.57.121.25 port 27832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.3
country_id: 3469034
description:
Nov 14 15:38:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.89.137.3, lip=66.85.158.91, TLS, session=<wbWRK4tDcdy+WYkD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.26
country_id: 798544
description:
Nov 14 15:38:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=109.125.247.26, lip=66.85.158.91, TLS, session=<ygXyLItD0sttffca>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.246.87.86
country_id: 2921044
description:
2025-11-14 15:38:36 H=([92.246.87.86]) [92.246.87.86]:62734 F=<zaapaiacelectric@gmail.com> rejected RCPT <contact@bostonlanka.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 15:39:23 host2 sshd[3797907]: Disconnected from invalid user admin 2.57.121.112 port 11183 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-14 15:47:18 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:45962: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-14 15:47:39 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:60521: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-11-14 15:47:50 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:47960: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.58
country_id: 3865483
description:
2025-11-14 15:47:55 dovecot_login authenticator failed for (ADMIN) [146.70.38.58]:10871: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.83.33
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 46.110.83.33 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-11-14 15:52:17 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (contorium) [73.183.74.177]:43472: 535 Incorrect authentication data (set_id=support@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 15:53:52 host2 sshd[3819500]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2025-11-14 15:53:35 dovecot_plain authenticator failed for (assisevan) [195.133.156.133]:48377: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 15:54:51 host2 sshd[3820550]: Disconnected from invalid user aryanna 62.60.131.157 port 38325 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.75
country_id: 3469034
description:
Nov 14 15:58:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=138.186.197.75, lip=66.85.158.91, TLS, session=<5mmedItDuZKKusVL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.87.249.99
country_id: 798544
description:
Nov 14 15:58:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=212.87.249.99, lip=66.85.158.91, TLS, session=<DQ3EdYtD6KvUV/lj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-11-14 16:00:01 dovecot_plain authenticator failed for (spasm) [65.20.160.107]:38195: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-14 16:03:14 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:53906: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.33
country_id: 2750405
description:
Nov 14 16:02:25 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=80.82.77.33, lip=66.85.158.92, session=<lMRyg4tDHLhQUk0h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-14 16:02:36 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:60384: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-11-14 16:02:45 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:44798: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-11-14 16:03:00 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:55186: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-14 16:03:00 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:55102: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-14 16:03:27 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (unced) [68.46.148.180]:52604: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:07:36 host2 sshd[3828601]: Disconnected from invalid user user42 172.245.168.112 port 48458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:09:56 host2 sshd[3829978]: Disconnected from invalid user bitrix 172.245.168.112 port 60012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.145.141
country_id: 6252001
description:
2025-11-14 16:10:13 dovecot_login authenticator failed for (ADMIN) [102.129.145.141]:48408: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:11:04 host2 sshd[3831027]: Disconnected from invalid user victor 172.245.168.112 port 51338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:12:07 host2 sshd[3831557]: Disconnected from invalid user cat 172.245.168.112 port 47332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 14 16:13:10 host2 sshd[3832341]: Disconnected from invalid user lee 172.245.168.112 port 35750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-11-14 16:12:29 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (polar) [66.177.30.53]:41610: 535 Incorrect authentication data (set_id=support@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:13:50 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<QVFKrItDxNcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:15:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<6ainsItDsIEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:16:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<WaIgt4tDgL8DlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.174.21.67
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.174.21.67 - greentaraceylon "GET /login/?login_only=1&user=greentaraceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylon (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:18:05 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<93iHu4tDwJwDlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.189.68.229
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.189.68.229 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.205.226.110
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.205.226.110 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.80.237.13
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 170.80.237.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.160.226.84
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 125.160.226.84 - greentaraceyloncom "GET /login/?login_only=1&user=greentaraceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 16:18:50 host2 pure-ftpd[3835517]: (?@217.119.139.27) [INFO] New connection from 217.119.139.27


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.3.151
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.158.3.151 - greentaracey "GET /login/?login_only=1&user=greentaracey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaracey (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:19:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<+3MJwItDBLYDlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.153.34
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.244.153.34 - greentaraceylo "GET /login/?login_only=1&user=greentaraceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.24.160.1
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.24.160.1 - greentaraceyl "GET /login/?login_only=1&user=greentaraceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentaraceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.20.115
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.19.20.115 - greentarace "GET /login/?login_only=1&user=greentarace&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentarace (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.179.149.94
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.179.149.94 - greentarac "GET /login/?login_only=1&user=greentarac&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentarac (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.169.127.74
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.169.127.74 - gr "GET /login/?login_only=1&user=gr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.169.102.80
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.169.102.80 - greentar "GET /login/?login_only=1&user=greentar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.158.200.22
country_id: 3437598
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.158.200.22 - green "GET /login/?login_only=1&user=green&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user green (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.200.50.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.200.50.64 - greent "GET /login/?login_only=1&user=greent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.96.28.81
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.96.28.81 - gree "GET /login/?login_only=1&user=gree&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gree (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.208.244.43
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.208.244.43 - gre "GET /login/?login_only=1&user=gre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gre (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.115.218.237
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.115.218.237 - greenta1 "GET /login/?login_only=1&user=greenta1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.238.51.145
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.238.51.145 - greenta2 "GET /login/?login_only=1&user=greenta2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta2 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:19:26 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<xFZRwItDWIMDlTsa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.209.10.22
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.209.10.22 - greentara "GET /login/?login_only=1&user=greentara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.254.82.44
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.254.82.44 - greenta "GET /login/?login_only=1&user=greenta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greenta (has_cpuser_file failed)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:20:18 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<ZN9rw4tDmLEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.138
country_id: 3017382
description:
Nov 14 16:20:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.138, lip=66.85.158.91, session=<72hTxItDBYNb51mK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:20:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<y9zTxItD8NsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.246
country_id: 3017382
description:
Nov 14 16:20:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.246, lip=66.85.158.91, session=<NYHwxItDVYBb51n2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.141
country_id: 3017382
description:
Nov 14 16:20:57 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.141, lip=66.85.158.91, session=<HPHCxYtDF9Rb51mN>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:21:43 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<wTCAyItDbrcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:22:06 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<sivhyYtDvrQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 14 16:23:28 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<pLDGzotD/MUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.3
country_id: 6252001
description:
Nov 14 16:25:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.3, lip=66.85.158.92, session=<zd/91ItDr+dAPsUD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.134
country_id: 6252001
description:
Nov 14 16:25:45 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nbPq1otDw4JAPpyG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 14 16:25:50 host2 sshd[3839442]: Disconnected from invalid user steam 103.179.57.150 port 35482 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Nov 14 16:26:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<n1D714tDMOJAPpyE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov 14 16:25:26 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS: Connection closed, session=<DEHI1YtD+iNAPsUC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.83.162.167
country_id: 1168579
description:
Nov 14 16:25:28 host2 sshd[3839188]: Disconnected from invalid user steam 202.83.162.167 port 38634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 14 16:27:49 host2 sshd[3840455]: Disconnected from invalid user debian 103.179.57.150 port 49612 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 14 16:28:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<nBWv4YtDADhChJl7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov 14 16:30:18 host2 pure-ftpd[3842213]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.90
country_id: 2629691
description:
2025-11-14 16:29:26 dovecot_login authenticator failed for (ADMIN) [45.133.193.90]:59126: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.107
country_id: 6252001
description:
Nov 14 16:33:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.107, lip=66.85.158.92, TLS: Connection closed, session=<OaKW8YtDkvLHLZtr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 14 16:33:31 host2 sshd[3843871]: Disconnected from invalid user kafka 103.179.57.150 port 49436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.83.162.167
country_id: 1168579
description:
Nov 14 16:33:55 host2 sshd[3844014]: Disconnected from invalid user morteza 202.83.162.167 port 33428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.196.217
country_id: 3469034
description:
Nov 14 16:35:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=138.186.196.217, lip=66.85.158.91, TLS, session=<QQ9k94tDnaSKusTZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.43
country_id: 953987
description:
Nov 14 16:35:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.129.61.43, lip=66.85.158.91, TLS, session=<I8GS+ItD2I9mgT0r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.17.38
country_id: 3175395
description:
Nov 14 16:36:35 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.43.17.38, lip=66.85.158.91, TLS, session=<0KaK/ItDd925KxEm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.140
country_id: 3175395
description:
Nov 14 16:36:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=171.22.235.140, lip=66.85.158.91, TLS, session=<Nd24/YtDirirFuuM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.102.49.193
country_id: 2750405
description:
Nov 14 16:50:43 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.102.49.193, lip=66.85.158.91, session=<Kw82MIxDLpZeZjHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-14 16:51:27 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:54320: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.63
country_id: 6252001
description:
2025-11-14 16:58:54 dovecot_login authenticator failed for (ADMIN) [102.129.235.63]:59920: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-14 17:09:45 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:43870: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-14 17:09:25 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:48987: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 17:10:28 host2 sshd[3866301]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:13:40 host2 sshd[3867866]: Disconnected from invalid user develop 138.204.127.54 port 59471 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 14 17:14:15 host2 sshd[3868354]: Disconnected from invalid user admin 101.36.108.134 port 41280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:15:08 host2 sshd[3868839]: Disconnected from invalid user dev 138.204.127.54 port 45472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:17:58 host2 sshd[3870304]: Disconnected from invalid user peace 138.204.127.54 port 45714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.6
country_id: 1819730
description:
2025-11-14 17:18:49 dovecot_login authenticator failed for (m121-202-152-6.smartone.com) [121.202.152.6]:9263: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.209.52.82
country_id: 3374766
description:
2025-11-14 17:19:07 dovecot_login authenticator failed for ([102.209.52.82]) [102.209.52.82]:59283: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:19:26 host2 sshd[3871173]: Disconnected from invalid user steam 138.204.127.54 port 59942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 14 17:20:34 host2 sshd[3871910]: Disconnected from invalid user odoo13 152.32.144.167 port 35764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 14 17:20:50 host2 sshd[3872127]: Disconnected from invalid user hadoop 138.204.127.54 port 45951 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 14 17:22:07 host2 sshd[3873017]: Disconnected from invalid user dspace 101.36.108.134 port 40208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 14 17:21:53 host2 sshd[3872895]: Disconnected from invalid user postgres 152.32.144.167 port 41550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 14 17:23:23 host2 sshd[3873759]: Disconnected from invalid user server 101.36.108.134 port 34284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.253
country_id: 3469034
description:
Nov 14 17:23:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=191.53.128.253, lip=66.85.158.91, TLS, session=<mG3epIxD2qC/NYD9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.141
country_id: 1269750
description:
Nov 14 17:23:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=103.164.246.141, lip=66.85.158.91, TLS, session=<6twapoxDY91npPaN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 14 17:24:39 host2 sshd[3874529]: Disconnected from invalid user team1 152.32.144.167 port 52358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 14 17:24:42 host2 sshd[3874556]: Disconnected from invalid user team1 101.36.108.134 port 59296 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 17:28:52 host2 sshd[3877010]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov 14 17:31:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS: Connection closed, session=<CVUjw4xDvORChJl5>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 14 17:33:48 host2 sshd[3879512]: Disconnecting authenticating user root 173.24.18.140 port 42674: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 14 17:33:48 host2 sshd[3879512]: error: maximum authentication attempts exceeded for root from 173.24.18.140 port 42674 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 14 17:33:56 host2 sshd[3879559]: error: maximum authentication attempts exceeded for invalid user admin from 173.24.18.140 port 44432 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 14 17:33:57 host2 sshd[3879593]: Disconnecting invalid user admin 173.24.18.140 port 44796: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-11-14 17:36:27 dovecot_plain authenticator failed for (cofitea) [65.20.133.208]:40680: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.186.7
country_id: 1819730
description:
Nov 14 17:38:56 host2 sshd[3882299]: Disconnected from invalid user ociistst 223.197.186.7 port 60643 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-11-14 17:39:45 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:50658: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-11-14 17:40:06 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:64662: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:41:32 host2 sshd[3883724]: Disconnected from invalid user sdc 43.156.89.50 port 46564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-14 17:44:21 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:39204: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.17
country_id: 1643084
description:
Nov 14 17:44:09 host2 sshd[3885105]: Disconnected from invalid user opsadmin 103.139.192.17 port 50608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.186.7
country_id: 1819730
description:
Nov 14 17:44:31 host2 sshd[3885366]: Disconnected from invalid user test 223.197.186.7 port 49891 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:45:40 host2 sshd[3886686]: Disconnected from invalid user dennis 43.156.89.50 port 34474 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.81
country_id: 6252001
description:
Nov 14 17:45:42 host2 pure-ftpd[3886700]: (?@199.45.155.81) [INFO] New connection from 199.45.155.81


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.197.186.7
country_id: 1819730
description:
Nov 14 17:46:12 host2 sshd[3886999]: Disconnected from invalid user dennis 223.197.186.7 port 26855 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.108.185
country_id: 3175395
description:
Nov 14 17:47:21 host2 sshd[3887744]: Disconnected from invalid user xiaoli 156.54.108.185 port 54597 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:48:58 host2 sshd[3888830]: Disconnected from invalid user sinusbot 43.156.89.50 port 41634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:52:19 host2 sshd[3891059]: Disconnected from invalid user rootadmin 43.156.89.50 port 48796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.17
country_id: 1643084
description:
Nov 14 17:52:31 host2 sshd[3891159]: Disconnected from invalid user student 103.139.192.17 port 39006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.89.50
country_id: 1880251
description:
Nov 14 17:53:54 host2 sshd[3891813]: Disconnected from invalid user dcm4chee 43.156.89.50 port 52364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.108.185
country_id: 3175395
description:
Nov 14 17:54:18 host2 sshd[3892353]: Disconnected from invalid user odoo 156.54.108.185 port 33846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.108.185
country_id: 3175395
description:
Nov 14 17:58:25 host2 sshd[3895820]: Disconnected from invalid user dennis 156.54.108.185 port 50616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.186.7
country_id: 1819730
description:
Nov 14 17:58:11 host2 sshd[3895732]: Disconnected from invalid user sdc 223.197.186.7 port 53401 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov 14 18:01:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: Connection closed, session=<V1yCLY1DnudChJmA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.221.4
country_id: 6252001
description:
2025-11-14 18:09:02 dovecot_login authenticator failed for (ADMIN) [37.19.221.4]:50804: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.159
country_id: 1880251
description:
Nov 14 18:09:26 host2 sshd[3903942]: Disconnected from invalid user gitea 45.78.206.159 port 60036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.159
country_id: 1880251
description:
Nov 14 18:14:39 host2 sshd[3907347]: Disconnected from invalid user gitlab 45.78.206.159 port 36512 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.120
country_id: 3469034
description:
Nov 14 18:15:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=138.186.197.120, lip=66.85.158.91, TLS, session=<GfHGX41D/6GKusV4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.143.194
country_id: 690791
description:
Nov 14 18:15:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=37.221.143.194, lip=66.85.158.91, TLS, session=<I7+sXo1D7Ool3Y/C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 18:21:50 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=217.119.139.27, lip=66.85.158.92, session=<9a8Pdo1DdtnZd4sb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.137.165
country_id: 6252001
description:
Nov 14 18:24:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.182.137.165, lip=66.85.158.91, session=<n5/UfY1D/oaTtoml>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.186
country_id: 6252001
description:
2025-11-14 18:27:40 dovecot_login authenticator failed for (ADMIN) [181.214.165.186]:60305: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:28:04 host2 sshd[3916094]: Disconnected from invalid user user15 92.85.115.214 port 37544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.91
country_id: 953987
description:
Nov 14 18:29:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=102.64.45.91, lip=66.85.158.91, TLS, session=<rfK7j41DN+BmQC1b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.156.235.155
country_id: 3175395
description:
Nov 14 18:28:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.156.235.155, lip=66.85.158.91, TLS, session=<kziOjo1D2qq5nOub>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 18:29:37 host2 sshd[3917169]: Disconnected from invalid user jefferson 62.60.131.157 port 22842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:31:13 host2 sshd[3918573]: Disconnected from invalid user user 92.85.115.214 port 34182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-14 18:31:40 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-14 18:31:53 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:59143: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.137.165
country_id: 6252001
description:
Nov 14 18:33:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.182.137.165, lip=66.85.158.92, session=<vXJAoI1D9KSTtoml>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:35:05 host2 sshd[3921546]: Disconnected from invalid user web 92.85.115.214 port 44736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.231.192.36
country_id: 1605651
description:
Nov 14 18:35:08 host2 sshd[3921530]: Disconnected from invalid user hydra 49.231.192.36 port 45491 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:37:49 host2 sshd[3923479]: Disconnected from invalid user pmf 92.85.115.214 port 51760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.231.192.36
country_id: 1605651
description:
Nov 14 18:37:53 host2 sshd[3923496]: Disconnected from invalid user ubuntu 49.231.192.36 port 60703 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.85.115.214
country_id: 798549
description:
Nov 14 18:39:17 host2 sshd[3924579]: Disconnected from invalid user hb 92.85.115.214 port 55276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.242
country_id: 3175395
description:
Nov 14 18:39:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=217.26.179.242, lip=66.85.158.91, TLS, session=<3fZntI1DJo7ZGrPy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.239.36.237
country_id: 3996063
description:
2025-11-14 18:39:47 dovecot_login authenticator failed for ([200.239.36.237]) [200.239.36.237]:50182: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.51.154
country_id: 3175395
description:
Nov 14 18:39:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.77.51.154, lip=66.85.158.91, TLS, session=<bPt6tY1D3bC5TTOa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-11-14 18:40:04 dovecot_login authenticator failed for ([180.94.74.122]) [180.94.74.122]:56547: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 14 18:42:02 host2 pure-ftpd[3926738]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 14 18:42:03 host2 pure-ftpd[3926757]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.37
country_id: 2963597
description:
2025-11-14 18:43:08 dovecot_login authenticator failed for (ADMIN) [155.2.194.37]:6437: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.159
country_id: 1880251
description:
Nov 14 18:44:04 host2 sshd[3927962]: Disconnected from invalid user tezos 45.78.206.159 port 47058 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 18:46:03 host2 sshd[3929643]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.67
country_id: 831053
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.35.67.67 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-14 18:50:57 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (catib) [81.225.30.107]:36983: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-14 18:57:10 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:34362: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.89
country_id: 831053
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.35.67.89 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.70.75.10
country_id: 3469034
description:
Nov 14 18:58:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.70.75.10, lip=66.85.158.91, TLS, session=<HvUe+Y1DH8qxRksK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.103.27
country_id: 798544
description:
Nov 14 18:59:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=178.219.103.27, lip=66.85.158.91, TLS, session=<gEZT+o1DscGy22cb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.231.192.36
country_id: 1605651
description:
Nov 14 18:59:39 host2 sshd[3939033]: Disconnected from invalid user admin 49.231.192.36 port 41262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.84.10
country_id: 1605651
description:
Nov 14 19:01:17 host2 sshd[3940403]: Disconnected from invalid user teamspeak 49.228.84.10 port 56736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 14 19:02:07 host2 sshd[3940834]: Disconnected from invalid user zone 204.152.195.145 port 42032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.55
country_id: 597427
description:
2025-11-14 19:02:37 dovecot_login authenticator failed for (ADMIN) [194.32.122.55]:59948: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 19:03:43 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52716: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 19:04:40 host2 sshd[3942394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.84.10
country_id: 1605651
description:
Nov 14 19:06:00 host2 sshd[3943299]: Disconnected from invalid user light 49.228.84.10 port 38618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 14 19:07:57 host2 sshd[3944332]: Disconnected from invalid user wyk 204.152.195.145 port 42576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 14 19:10:13 host2 sshd[3945699]: Disconnected from invalid user wallabag 204.152.195.145 port 42804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.102.180.155
country_id: 6252001
description:
Nov 14 19:09:36 host2 sshd[3945217]: Disconnected from invalid user reza 67.102.180.155 port 56614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.102.180.155
country_id: 6252001
description:
Nov 14 19:10:52 host2 sshd[3945946]: Disconnected from invalid user kafka 67.102.180.155 port 59450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.213.226.156
country_id: 6252001
description:
Nov 14 19:16:15 host2 sshd[3949219]: Disconnected from invalid user finn 129.213.226.156 port 56094 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 14 19:16:13 host2 pure-ftpd[3949179]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.59.218
country_id: 1269750
description:
Nov 14 19:16:48 host2 sshd[3949414]: Disconnected from invalid user adama 125.21.59.218 port 44258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 19:18:23 host2 sshd[3950239]: Disconnected from invalid user  2.57.121.112 port 62701 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.237
country_id: 3469034
description:
Nov 14 19:19:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.251.237, lip=66.85.158.91, TLS, session=<rmiJQ45Dmae60fvt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 14 19:19:53 host2 pure-ftpd[3950996]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 14 19:19:53 host2 pure-ftpd[3951008]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.177
country_id: 3469034
description:
Nov 14 19:19:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=177.44.96.177, lip=66.85.158.91, TLS, session=<zA/RRI5DKoixLGCx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.213.226.156
country_id: 6252001
description:
Nov 14 19:20:56 host2 sshd[3951663]: Disconnected from invalid user vmarketing 129.213.226.156 port 57004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.156.106
country_id: 1880251
description:
Nov 14 19:21:11 host2 sshd[3951818]: Disconnected from invalid user rahul 8.219.156.106 port 48434 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.40
country_id: 2635167
description:
Nov 14 19:24:41 host2 pure-ftpd[3953445]: (?@185.247.137.40) [INFO] New connection from 185.247.137.40


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 19:25:13 host2 sshd[3953778]: Disconnected from invalid user jefferson 62.60.131.157 port 19268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-11-14 19:26:27 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:42596: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-14 19:26:47 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:32952: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-11-14 19:27:44 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:58036: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 19:28:00 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=217.119.139.27, lip=66.85.158.92, session=<OQ2tYo5DsLHZd4sb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-11-14 19:28:13 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:55268: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.226
country_id: 3017382
description:
2025-11-14 19:28:33 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.226]:45354: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.23
country_id: 174982
description:
2025-11-14 19:29:42 dovecot_login authenticator failed for (ADMIN) [185.253.160.23]:48506: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.66
country_id: 831053
description:
[2025-11-14 19:29:52 +0530] info [cpaneld] 37.35.67.66 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-14 19:34:41 dovecot_login authenticator failed for ([179.185.18.67]) [179.185.18.67]:47312: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.16
country_id: 1269750
description:
2025-11-14 19:35:03 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:38026: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.107.6
country_id: 798544
description:
Nov 14 19:38:07 host2 sshd[3961555]: Disconnected from invalid user ubuntu 83.168.107.6 port 41084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.107.6
country_id: 798544
description:
Nov 14 19:40:57 host2 sshd[3963342]: Disconnected from invalid user user1 83.168.107.6 port 48310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:41:15 host2 sshd[3963497]: Disconnected from invalid user marlon 189.126.4.42 port 37540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.107.6
country_id: 798544
description:
Nov 14 19:42:10 host2 sshd[3963967]: Disconnected from invalid user paul 83.168.107.6 port 37026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 19:42:31 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=217.119.139.27, lip=66.85.158.91, session=<Vw6Xlo5Drr7Zd4sb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:44:25 host2 sshd[3965410]: Disconnected from invalid user sysadmin 189.126.4.42 port 43378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.107.6
country_id: 798544
description:
Nov 14 19:45:05 host2 sshd[3965953]: Disconnected from invalid user master 83.168.107.6 port 51886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:45:55 host2 sshd[3966815]: Disconnected from invalid user ruth 189.126.4.42 port 46464 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:47:25 host2 sshd[3967639]: Disconnected from invalid user chris 189.126.4.42 port 49394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Nov 14 19:47:30 host2 sshd[3967668]: Disconnected from invalid user sangoma 187.107.88.97 port 37294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 14 19:48:48 host2 sshd[3968304]: Disconnected from invalid user test 189.126.4.42 port 52422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.40
country_id: 617790
description:
2025-11-14 19:50:32 dovecot_login authenticator failed for (ADMIN) [178.175.128.40]:54843: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-14 19:51:15 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:36940: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-11-14 19:51:34 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:38194: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.41.154.21
country_id: 3017382
description:
2025-11-14 19:52:35 dovecot_plain authenticator failed for vps-83371.fhnet.fr (vps-83371.firstheberg.net) [185.41.154.21]:52507: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.57
country_id: 6251999
description:
Nov 14 19:55:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.57, lip=66.85.158.91, session=<zCoXxY5DJLaUccE5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.107.88.97
country_id: 3469034
description:
Nov 14 20:00:19 host2 sshd[3976031]: Disconnected from invalid user master 187.107.88.97 port 49671 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 20:01:56 host2 sshd[3976840]: Disconnected from invalid user admin 2.57.121.112 port 48758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.198.17.88
country_id: 130758
description:
Nov 14 20:02:06 host2 sshd[3976921]: Disconnected from invalid user jason 85.198.17.88 port 52782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Nov 14 20:06:48 host2 sshd[3980070]: Disconnected from invalid user rustserver 187.107.88.97 port 40063 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.3.205
country_id: 2661886
description:
2025-11-14 20:09:20 dovecot_login authenticator failed for (ADMIN) [46.246.3.205]:9577: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 14 20:09:31 host2 sshd[3981898]: Disconnected from invalid user administrator 135.235.138.43 port 42512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 14 20:11:09 host2 sshd[3982825]: Disconnected from invalid user docker 135.235.138.43 port 47772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 14 20:14:09 host2 sshd[3984598]: Disconnected from invalid user ambari 135.235.138.43 port 35170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 14 20:19:04 host2 sshd[3987167]: Disconnected from invalid user fahim 135.235.138.43 port 37094 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 20:22:20 host2 sshd[3988760]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.222.81
country_id: 6252001
description:
Nov 14 20:21:39 host2 pure-ftpd[3988435]: (?@146.190.222.81) [INFO] New connection from 146.190.222.81


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 14 20:22:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<IR+vJo9D9GxChJmL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.186
country_id: 226074
description:
Nov 14 20:24:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=196.0.107.186, lip=66.85.158.91, TLS, session=<TjFeKo9DgpTEAGu6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.80.18
country_id: 1269750
description:
Nov 14 20:23:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.30.80.18, lip=66.85.158.91, TLS, session=<fnw/KI9DeddnHlAS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.186
country_id: 3469034
description:
Nov 14 20:23:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=186.209.251.186, lip=66.85.158.91, TLS, session=<+naHKY9Ddt660fu6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.18
country_id: 226074
description:
Nov 14 20:24:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<jagath.peiris>, method=PLAIN, rip=196.0.10.18, lip=66.85.158.91, TLS, session=<6EixK49D06bEAAoS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.0.20
country_id: 2750405
description:
Nov 14 20:25:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.0.20, lip=66.85.158.92, TLS: Connection closed, session=<YAerMY9D5pyf3wAU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.201
country_id: 798549
description:
2025-11-14 20:29:21 dovecot_login authenticator failed for (ADMIN) [91.90.120.201]:32382: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:30:56 host2 sshd[3993895]: Disconnected from invalid user debian 154.82.84.134 port 38168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 20:30:41 host2 sshd[3993791]: Disconnected from invalid user user 2.57.121.25 port 26051 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.22.82
country_id: 2921044
description:
Nov 14 20:32:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.22.82, lip=66.85.158.91, TLS handshaking: Connection closed, session=<30GSSI9DppKd5hZS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:32:24 host2 sshd[3994601]: Disconnected from invalid user deploy 154.82.84.134 port 33348 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.28.108
country_id: 2921044
description:
Nov 14 20:31:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.28.108, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<UYN2Ro9Dg7lo+Bxs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-11-14 20:37:05 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:42260: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.239.36.237
country_id: 3996063
description:
2025-11-14 20:37:22 dovecot_login authenticator failed for ([200.239.36.237]) [200.239.36.237]:40220: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.198.17.88
country_id: 130758
description:
Nov 14 20:37:34 host2 sshd[3997560]: Disconnected from invalid user docker 85.198.17.88 port 50832 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:38:35 host2 sshd[3998057]: Disconnected from invalid user deploy 154.82.84.134 port 50400 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 20:40:58 host2 sshd[3999363]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:41:32 host2 sshd[3999713]: Disconnected from invalid user username 154.82.84.134 port 42448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Nov 14 20:43:03 host2 sshd[4000417]: Disconnected from invalid user ftptest 154.82.84.134 port 60220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.20
country_id: 1522867
description:
2025-11-14 20:52:44 dovecot_login authenticator failed for (ADMIN) [62.133.47.20]:19052: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.218
country_id: 6252001
description:
Nov 14 20:56:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.218, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<snOFnY9Dm8Ci2Jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.42.20
country_id: 2395170
description:
Nov 14 20:57:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=154.127.42.20, lip=66.85.158.91, TLS, session=<FoEsoY9D06qafyoU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.42
country_id: 298795
description:
Nov 14 20:57:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=95.0.171.42, lip=66.85.158.91, TLS, session=<8P9Zoo9DrMFfAKsq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.218
country_id: 6252001
description:
Nov 14 21:02:16 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.218, lip=66.85.158.91, TLS, session=<whTUs49DSOii2Jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.216
country_id: 6252001
description:
2025-11-14 21:13:36 dovecot_login authenticator failed for (ADMIN) [181.215.182.216]:57828: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.184.82.46
country_id: 798544
description:
Nov 14 21:13:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=195.184.82.46, lip=66.85.158.91, TLS, session=<FiuI249Dfc/DuFIu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.171.150.189
country_id: 3469034
description:
Nov 14 21:13:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=45.171.150.189, lip=66.85.158.91, TLS, session=<8USq3I9DtNgtq5a9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.160.172.181
country_id: 798544
description:
Nov 14 21:16:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=82.160.172.181, lip=66.85.158.91, TLS, session=<01kB5Y9Dx5pSoKy1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.78.89.44
country_id: 298795
description:
Nov 14 21:16:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=94.78.89.44, lip=66.85.158.91, TLS, session=<KkoZ5o9Do7ReTlks>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-11-14 21:17:18 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:39482: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.131.8.20
country_id: 1168579
description:
2025-11-14 21:17:41 dovecot_login authenticator failed for ([103.131.8.20]) [103.131.8.20]:52106: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.252.75
country_id: 3865483
description:
Nov 14 21:23:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=200.229.252.75, lip=66.85.158.91, TLS, session=<1veu/o9DILrI5fxL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.41.84.60
country_id: 798544
description:
Nov 14 21:23:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=31.41.84.60, lip=66.85.158.91, TLS, session=<eWPp/49DjpIfKVQ8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.198.17.88
country_id: 130758
description:
Nov 14 21:24:56 host2 sshd[4024824]: Disconnected from invalid user proradis 85.198.17.88 port 36010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:25:11 host2 sshd[4025254]: Disconnected from invalid user suraj 84.241.107.69 port 49756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.17
country_id: 1733045
description:
2025-11-14 21:25:13 dovecot_login authenticator failed for ([49.124.151.17]) [49.124.151.17]:41222: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-11-14 21:25:28 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:39514: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 21:26:40 host2 sshd[4025934]: Disconnected from invalid user admin 2.57.121.112 port 55903 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-14 21:27:16 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:52862: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-11-14 21:27:52 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:52984: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov 14 21:28:37 host2 pure-ftpd[4026824]: (?@64.62.156.182) [INFO] New connection from 64.62.156.182


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:29:22 host2 sshd[4027273]: Disconnected from invalid user clamav 84.241.107.69 port 50438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:29:54 host2 sshd[4027621]: Disconnected from invalid user super 118.193.40.35 port 49194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Nov 14 21:30:03 host2 sshd[4027728]: Disconnected from invalid user hieu 202.157.177.33 port 58100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:31:41 host2 sshd[4028712]: Disconnected from invalid user user123 84.241.107.69 port 58552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Nov 14 21:32:50 host2 sshd[4029580]: Disconnected from invalid user clamav 202.157.177.33 port 47816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:34:10 host2 sshd[4030834]: Disconnected from invalid user testadmin 118.193.40.35 port 8314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.164
country_id: 3865483
description:
Nov 14 21:35:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=190.122.128.164, lip=66.85.158.91, TLS, session=<X7mlKpBDgca+eoCk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:35:13 host2 sshd[4031560]: Disconnected from invalid user ftpuser 84.241.107.69 port 36176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.105.102
country_id: 6252001
description:
2025-11-14 21:35:21 dovecot_login authenticator failed for (ADMIN) [154.16.105.102]:6887: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.33.78.42
country_id: 3469034
description:
Nov 14 21:35:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.33.78.42, lip=66.85.158.91, TLS, session=<Uz5gKZBDZ+q7IU4q>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.70
country_id: 831053
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.35.67.70 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:36:18 host2 sshd[4032171]: Disconnected from invalid user ubuntu 84.241.107.69 port 33592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:40:53 host2 sshd[4034426]: Disconnected from invalid user account 84.241.107.69 port 44164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.33
country_id: 1733045
description:
Nov 14 21:42:05 host2 sshd[4035116]: Disconnected from invalid user tomas 202.157.177.33 port 48488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:42:36 host2 sshd[4035307]: Disconnected from invalid user ftpuser 118.193.40.35 port 1638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Nov 14 21:43:26 host2 sshd[4035750]: Disconnected from invalid user ansible 202.157.177.33 port 46636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.241.107.69
country_id: 2658434
description:
Nov 14 21:46:52 host2 sshd[4037552]: Disconnected from invalid user tomas 84.241.107.69 port 34290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:47:31 host2 sshd[4037838]: Disconnected from invalid user admin 118.193.40.35 port 47478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:47:42 host2 sshd[4037901]: Disconnected from invalid user user12 79.106.102.70 port 48434 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 14 21:48:55 host2 pure-ftpd[4038573]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 14 21:48:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<E46gWpBD1oYzn+p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 14 21:50:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<r6l9YZBD0lpBMRRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 14 21:51:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, session=<RkwuYpBDPJq4affD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:51:31 host2 sshd[4040071]: Disconnected from invalid user wd 79.106.102.70 port 36772 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 14 21:51:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS: Connection closed, session=<75/sYpBDkom4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 14 21:51:16 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<klsIY5BDtlxBMRRC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:52:50 host2 sshd[4040607]: Disconnected from invalid user cesar 79.106.102.70 port 41674 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.185.240
country_id: 6252001
description:
Nov 14 21:53:42 host2 pure-ftpd[4041024]: (?@44.220.185.240) [INFO] New connection from 44.220.185.240


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.40.35
country_id: 1819730
description:
Nov 14 21:55:34 host2 sshd[4042487]: Disconnected from invalid user vod 118.193.40.35 port 19254 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.222.81
country_id: 6252001
description:
Nov 14 21:56:02 host2 pure-ftpd[4042732]: (?@146.190.222.81) [INFO] New connection from 146.190.222.81


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:56:33 host2 sshd[4043035]: Disconnected from invalid user filip 79.106.102.70 port 57858 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.112
country_id: 6252001
description:
Nov 14 21:57:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.112, lip=66.85.158.91, session=<8lbHeZBDoJoUQcFw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 21:58:13 host2 sshd[4044909]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.129.35
country_id: 617790
description:
2025-11-14 21:58:26 dovecot_login authenticator failed for (ADMIN) [178.175.129.35]:47002: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 14 21:59:01 host2 sshd[4045429]: Disconnected from invalid user user 79.106.102.70 port 46420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:00:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MvKyhZBDYd+i2JXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:01:19 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<OsIDh5BDRPyi2JXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:02:20 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<YEehipBDAvai2JXs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Nov 14 22:02:41 host2 sshd[4048510]: Disconnected from invalid user zahid 155.93.89.195 port 34570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.93.89.195
country_id: 2328926
description:
Nov 14 22:07:49 host2 sshd[4065575]: Disconnected from invalid user samba 155.93.89.195 port 36536 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.38
country_id: 6252001
description:
Nov 14 22:07:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6R26npBDmUFAPpwm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:07:34 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS, session=<ys1YnZBD5vGi2JXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.38
country_id: 6252001
description:
Nov 14 22:08:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<kle+n5BDpLhAPpwm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.236
country_id: 6252001
description:
Nov 14 22:08:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.236, lip=66.85.158.92, TLS, session=<TNUVoZBDrPmi2JXs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-11-14 22:13:33 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (aguiselege) [69.123.219.82]:53911: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-11-14 22:14:09 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (shious) [76.145.10.140]:57282: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Nov 14 22:14:20 host2 sshd[4069237]: Disconnected from invalid user odoo 155.93.89.195 port 40698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-14 22:16:09 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:33081: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-14 22:16:29 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:33684: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.82.22
country_id: 6252001
description:
Nov 14 22:20:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.165.82.22, lip=66.85.158.92, session=<8573yZBDnM00pVIW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 14 22:21:40 host2 sshd[4073004]: Disconnected from invalid user ibrahim 103.106.194.74 port 42042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.196
country_id: 798549
description:
2025-11-14 22:23:10 dovecot_login authenticator failed for (ADMIN) [91.90.120.196]:7809: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 14 22:24:38 host2 sshd[4074265]: Disconnected from invalid user teamspeak 103.106.194.74 port 37948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.211.140
country_id: 3175395
description:
Nov 14 22:31:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=94.198.211.140, lip=66.85.158.91, TLS, session=<sRC98JBDEbZextOM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.81
country_id: 3996063
description:
Nov 14 22:31:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=138.122.97.81, lip=66.85.158.91, TLS, session=<PmLr8ZBDS66KemFR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.81
country_id: 6252001
description:
Nov 14 22:37:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.81, lip=66.85.158.91, session=<JPagBpFD6RBBMQFR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov 14 22:37:10 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.80, lip=66.85.158.91, TLS: Connection closed, session=<+Oc7B5FDmH9BMQFQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-14 22:37:20 dovecot_plain authenticator failed for (impaske) [46.8.245.34]:44276: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.119
country_id: 6251999
description:
2025-11-14 22:41:24 dovecot_login authenticator failed for (ADMIN) [89.149.52.119]:36363: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.212
country_id: 6252001
description:
Nov 14 22:42:37 host2 pure-ftpd[4084503]: (?@64.62.197.212) [INFO] New connection from 64.62.197.212


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.183
country_id: 6252001
description:
Nov 14 22:43:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.183, lip=66.85.158.91, session=<IJMEH5FDbIkUQcG3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.102.92.72
country_id: 6252001
description:
Nov 14 22:45:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.102.92.72, lip=66.85.158.92, session=<1+51I5FDhIQUZlxI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.82.66
country_id: 1269750
description:
Nov 14 22:45:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=103.30.82.66, lip=66.85.158.91, TLS, session=<CousJJFDj99nHlJC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.109
country_id: 953987
description:
Nov 14 22:45:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.64.33.109, lip=66.85.158.91, TLS, session=<hH5jI5FD9odmQCFt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.186.228.106
country_id: 3923057
description:
2025-11-14 22:45:43 dovecot_login authenticator failed for (static-ip-adsl-190.186.228.106.cotas.com.bo) [190.186.228.106]:53118: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-14 22:46:08 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:53549: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 22:49:19 host2 sshd[4088725]: Disconnected from invalid user admin 2.57.121.112 port 56322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 22:51:38 host2 sshd[4089996]: Disconnected from invalid user service 2.57.121.112 port 62217 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 22:57:09 host2 sshd[4093812]: Disconnected from invalid user dallas 62.60.131.157 port 8014 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.40
country_id: 6252001
description:
Nov 14 22:57:45 host2 pure-ftpd[4094055]: (?@147.185.132.40) [INFO] New connection from 147.185.132.40


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 22:58:13 host2 sshd[4094361]: Disconnected from invalid user  2.57.121.112 port 61204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.9
country_id: 1227603
description:
2025-11-14 23:03:49 dovecot_login authenticator failed for (ADMIN) [95.181.239.9]:52052: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.111
country_id: 6252001
description:
Nov 14 23:06:18 host2 pure-ftpd[4099242]: (?@147.185.132.111) [INFO] New connection from 147.185.132.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 23:07:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62513: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov 14 23:09:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.91, session=<HMG2eZFD1tKUcd0c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.42
country_id: 6252001
description:
Nov 14 23:21:11 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rpWhpJFDIuMUQcIq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.241.35
country_id: 6252001
description:
Nov 14 23:21:26 host2 pure-ftpd[4109412]: (?@20.118.241.35) [INFO] New connection from 20.118.241.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 23:24:24 host2 sshd[4110908]: Disconnected from invalid user admin 2.57.121.112 port 9480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.225
country_id: 6252001
description:
Nov 14 23:25:16 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.175.225, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<khA4s5FD7MIofK/h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.19.45
country_id: 3175395
description:
Nov 14 23:25:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.43.19.45, lip=66.85.158.91, TLS, session=<GI7gspFDnoW5KxMt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.179.38
country_id: 3175395
description:
Nov 14 23:25:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.68.179.38, lip=66.85.158.91, TLS, session=<o/T6s5FD/oq5RLMm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.30
country_id: 3042225
description:
2025-11-14 23:25:59 dovecot_login authenticator failed for (ADMIN) [91.90.124.30]:64502: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 23:29:16 host2 sshd[4113794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.254.230
country_id: 2921044
description:
Nov 14 23:28:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=207.154.254.230, lip=66.85.158.91, session=<4u4BwJFDdyjPmv7m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.215.207
country_id: 2921044
description:
Nov 14 23:28:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.59.215.207, lip=66.85.158.91, session=<3B0QwJFD6gWLO9fP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.249.221.45
country_id: 6252001
description:
Nov 14 23:32:49 host2 pure-ftpd[4115783]: (?@52.249.221.45) [INFO] New connection from 52.249.221.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:12 host2 pure-ftpd[4118276]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:17 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.92, TLS, session=<k8oz3pFDHueUccE7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:26 host2 pure-ftpd[4118382]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:26 host2 pure-ftpd[4118384]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 14 23:37:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xMHZ3pFDpuGUccE7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 23:44:43 host2 sshd[4122088]: Disconnected from invalid user user 2.57.121.25 port 22355 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 23:47:23 host2 sshd[4124165]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.149
country_id: 2782113
description:
2025-11-14 23:47:33 dovecot_login authenticator failed for (ADMIN) [156.146.60.149]:38342: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-14 23:48:28 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:49569: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-11-14 23:48:38 dovecot_login authenticator failed for (24-105-248-218.ip.mhcable.com) [24.105.248.218]:41320: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.36.183
country_id: 953987
description:
Nov 14 23:49:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=102.64.36.183, lip=66.85.158.91, TLS, session=<HKgGCpJDfNJmQCS3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-14 23:50:20 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (graver) [85.225.19.144]:58273: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.82.157.205
country_id: 1269750
description:
Nov 14 23:49:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.82.157.205, lip=66.85.158.91, TLS, session=<ms21CJJDhcZnUp3N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.171
country_id: 6252001
description:
Nov 15 00:03:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.171, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PyCoO5JDvdDG6xir>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.193.17
country_id: 2750405
description:
Nov 15 00:05:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=159.65.193.17, lip=66.85.158.91, TLS: Connection closed, session=<vzZrQZJDbOefQcER>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.58
country_id: 6251999
description:
2025-11-15 00:06:05 dovecot_login authenticator failed for (ADMIN) [212.56.52.58]:57708: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 00:07:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9M9HS5JDNsa4aYtF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 00:08:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, TLS: Connection closed, session=<mzNwTZJDWE24aYtF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 00:10:16 host2 sshd[4140189]: Disconnected from invalid user admin 2.57.121.112 port 20058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.199.171.246
country_id: 1269750
description:
2025-11-15 00:09:28 dovecot_login authenticator failed for ([116.199.171.246]) [116.199.171.246]:40226: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-11-15 00:09:55 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:54422: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.146.105
country_id: 690791
description:
Nov 15 00:10:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.221.146.105, lip=66.85.158.91, TLS, session=<DZoXVJJD68ol3ZJp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.158
country_id: 3865483
description:
Nov 15 00:10:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=45.238.106.158, lip=66.85.158.91, TLS, session=<BNaDVZJDK8It7mqe>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.148
country_id: 6252001
description:
Nov 15 00:13:48 host2 pure-ftpd[4142285]: (?@20.65.193.148) [INFO] New connection from 20.65.193.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-15 00:14:40 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:33312: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.158.224.90
country_id: 2658434
description:
2025-11-15 00:15:09 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:57288: 535 Incorrect authentication data (set_id=careers)


