# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 60.246.120.30
country_id: 1821275
description:
Dec 24 14:34:28 host2 sshd[2174481]: Disconnecting invalid user admin 60.246.120.30 port 51382: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.169.142.214
country_id: 2963597
description:
Dec 24 14:35:45 host2 sshd[2176025]: Disconnected from invalid user developer 52.169.142.214 port 52148 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.10.126.73
country_id: 6252001
description:
[2025-12-24 14:37:13 +0530] info [cpaneld] 66.10.126.73 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.131.16.255
country_id: 6252001
description:
[2025-12-24 14:37:14 +0530] info [cpaneld] 174.131.16.255 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:36:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<wrJ6+a5GqJcDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.230.102.130
country_id: 3996063
description:
Dec 24 14:37:06 host2 sshd[2177400]: Disconnected from invalid user teamspeak 187.230.102.130 port 57684 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.202.121
country_id: 6252001
description:
[2025-12-24 14:37:16 +0530] info [cpaneld] 172.89.202.121 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.103.80.209
country_id: 6252001
description:
[2025-12-24 14:37:18 +0530] info [whostmgrd] 172.103.80.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.89.227
country_id: 6252001
description:
[2025-12-24 14:37:39 +0530] info [cpaneld] 174.160.89.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 24 14:37:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ayfn/K5G6NcDhpQ7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.170.69.184
country_id: 6252001
description:
[2025-12-24 14:37:22 +0530] info [cpaneld] 67.170.69.184 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.54.6.190
country_id: 6252001
description:
[2025-12-24 14:37:36 +0530] info [cpaneld] 104.54.6.190 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.159.198.202
country_id: 6252001
description:
[2025-12-24 14:37:42 +0530] info [whostmgrd] 73.159.198.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.117.20.244
country_id: 6252001
description:
[2025-12-24 14:37:43 +0530] info [cpaneld] 23.117.20.244 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.172.203.181
country_id: 6252001
description:
[2025-12-24 14:37:46 +0530] info [cpaneld] 207.172.203.181 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.9.13
country_id: 6252001
description:
[2025-12-24 14:37:44 +0530] info [cpaneld] 38.43.9.13 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.205.118.8
country_id: 6252001
description:
[2025-12-24 14:37:21 +0530] info [cpaneld] 151.205.118.8 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.69.44.89
country_id: 6252001
description:
[2025-12-24 14:37:24 +0530] info [cpaneld] 68.69.44.89 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.187.146.60
country_id: 6252001
description:
[2025-12-24 14:37:41 +0530] info [cpaneld] 173.187.146.60 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 14:38:32 host2 pure-ftpd[2178515]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.9
country_id: 798549
description:
Dec 24 14:41:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.9, lip=66.85.158.91, TLS: Connection closed, session=<Pqk6C69GRLlV2YwJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.103
country_id: 6252001
description:
Dec 24 14:43:55 host2 pure-ftpd[2183182]: (?@198.235.24.103) [INFO] New connection from 198.235.24.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.156.211.20
country_id: 6252001
description:
[2025-12-24 14:44:33 +0530] info [cpaneld] 38.156.211.20 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.82.249.158
country_id: 6252001
description:
[2025-12-24 14:44:22 +0530] info [cpaneld] 75.82.249.158 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.85.64.214
country_id: 6252001
description:
[2025-12-24 14:44:23 +0530] info [cpaneld] 146.85.64.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.137.98.142
country_id: 6252001
description:
[2025-12-24 14:44:27 +0530] info [whostmgrd] 166.137.98.142 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.248.18.238
country_id: 6252001
description:
[2025-12-24 14:44:25 +0530] info [cpaneld] 173.248.18.238 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.140.196.58
country_id: 6252001
description:
[2025-12-24 14:44:28 +0530] info [cpaneld] 107.140.196.58 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.119.15.49
country_id: 6252001
description:
[2025-12-24 14:44:30 +0530] info [cpaneld] 172.119.15.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-24 14:45:49 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:39643: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.81.169.66
country_id: 6252001
description:
[2025-12-24 14:47:13 +0530] info [cpaneld] 74.81.169.66 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.200.86.174
country_id: 6252001
description:
[2025-12-24 14:47:16 +0530] info [cpaneld] 71.200.86.174 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-24 14:46:22 dovecot_login authenticator failed for H=(201.173.250.36-clientes-izzi.mx) [201.173.250.36]:41505: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.86.148.104
country_id: 6252001
description:
[2025-12-24 14:47:12 +0530] info [whostmgrd] 76.86.148.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.145.37.244
country_id: 6252001
description:
[2025-12-24 14:47:10 +0530] info [cpaneld] 47.145.37.244 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.212.30
country_id: 6252001
description:
[2025-12-24 14:47:15 +0530] info [cpaneld] 76.34.212.30 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.29.116.216
country_id: 6252001
description:
[2025-12-24 14:47:08 +0530] info [cpaneld] 174.29.116.216 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.33.194.154
country_id: 6252001
description:
[2025-12-24 14:47:09 +0530] info [cpaneld] 99.33.194.154 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-24 14:48:07 dovecot_login authenticator failed for H=(dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:34054: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-12-24 14:48:40 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:32910: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.173.216.172
country_id: 6252001
description:
[2025-12-24 14:48:47 +0530] info [cpaneld] 73.173.216.172 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.72.174
country_id: 6252001
description:
[2025-12-24 14:48:48 +0530] info [cpaneld] 167.248.72.174 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.210.241.220
country_id: 6252001
description:
[2025-12-24 14:48:52 +0530] info [whostmgrd] 97.210.241.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.62.179.134
country_id: 6252001
description:
[2025-12-24 14:48:55 +0530] info [cpaneld] 174.62.179.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.68.205.141
country_id: 6252001
description:
[2025-12-24 14:48:56 +0530] info [cpaneld] 199.68.205.141 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.4.181
country_id: 6252001
description:
[2025-12-24 14:48:46 +0530] info [cpaneld] 174.134.4.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.141.147.252
country_id: 6252001
description:
[2025-12-24 14:48:54 +0530] info [cpaneld] 47.141.147.252 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-12-24 14:49:28 1vYL1j-00000009BGj-3k1B <= wordpress@venee.lk U=veneelk P=local S=36251 id=QfmJjbcNgnA3r52BWhW3ztXYPVlLDohvotlXofwQocY@coatrent.venee.lk T="Failed login by IP 142.248.80.192 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.138
country_id: 3469034
description:
Dec 24 14:56:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=177.44.96.138, lip=66.85.158.91, TLS, session=<KmlVQK9GfcaxLGCK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.23.184.136
country_id: 3469034
description:
Dec 24 14:56:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.23.184.136, lip=66.85.158.91, TLS, session=<hByPQa9GudqxF7iI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.49.94.210
country_id: 6252001
description:
[2025-12-24 14:59:19 +0530] info [cpaneld] 38.49.94.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.191.115.177
country_id: 6252001
description:
[2025-12-24 14:59:20 +0530] info [cpaneld] 67.191.115.177 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.79.44.249
country_id: 6252001
description:
[2025-12-24 14:59:24 +0530] info [cpaneld] 73.79.44.249 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.82.193.47
country_id: 6252001
description:
[2025-12-24 14:59:38 +0530] info [whostmgrd] 99.82.193.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.179.181.115
country_id: 6252001
description:
[2025-12-24 14:59:42 +0530] info [cpaneld] 99.179.181.115 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.155.73.50
country_id: 6252001
description:
[2025-12-24 14:59:40 +0530] info [cpaneld] 192.155.73.50 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.194.151.213
country_id: 6252001
description:
[2025-12-24 14:59:43 +0530] info [cpaneld] 68.194.151.213 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.20.96.49
country_id: 6252001
description:
[2025-12-24 14:59:25 +0530] info [cpaneld] 76.20.96.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.50.160.28
country_id: 6252001
description:
[2025-12-24 14:59:32 +0530] info [cpaneld] 173.50.160.28 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.197.47.195
country_id: 6252001
description:
[2025-12-24 14:59:34 +0530] info [cpaneld] 72.197.47.195 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.168.238
country_id: 6252001
description:
[2025-12-24 14:59:22 +0530] info [cpaneld] 65.185.168.238 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 24 15:00:17 host2 sshd[2198415]: Disconnected from invalid user hadoop 209.141.52.88 port 48640 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.205.153.133
country_id: 6252001
description:
[2025-12-24 14:59:23 +0530] info [whostmgrd] 170.205.153.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.101.78
country_id: 6252001
description:
[2025-12-24 14:59:27 +0530] info [cpaneld] 73.199.101.78 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.72.107.253
country_id: 6252001
description:
[2025-12-24 14:59:36 +0530] info [cpaneld] 73.72.107.253 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.121
country_id: 6252001
description:
Dec 24 15:00:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.121, lip=66.85.158.91, TLS handshaking: Connection closed, session=<L8RMUa9GvskUQGl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-24 15:01:39 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:59384: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Dec 24 15:02:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.129, lip=66.85.158.91, TLS: Connection closed, session=<2KK0Va9GiLNChJmB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 24 15:02:40 host2 sshd[2200170]: Disconnected from invalid user u1 209.141.52.88 port 39276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.8
country_id: 798549
description:
Dec 24 15:02:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.8, lip=66.85.158.91, session=<gl4kWK9GYtFV2ZUI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-24 15:02:38 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:54372: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 24 15:07:20 host2 sshd[2204093]: Disconnected from invalid user test 209.141.52.88 port 48780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 15:07:40 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54006: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.34
country_id: 6252001
description:
Dec 24 15:09:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.34, lip=66.85.158.92, session=<Nbmkbq9Gq+bDuEwi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.244
country_id: 6252001
description:
Dec 24 15:09:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.244, lip=66.85.158.92, session=<UXLpb69GzdDDuEz0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.245
country_id: 6252001
description:
Dec 24 15:09:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.245, lip=66.85.158.92, session=<buVPb69G093DuEz1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.247
country_id: 6252001
description:
Dec 24 15:09:28 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.247, lip=66.85.158.92, session=<Jo+5b69Gz5fDuEz3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-24 15:10:43 dovecot_login authenticator failed for H=([186.238.247.238]) [186.238.247.238]:60902: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 15:11:36 host2 sshd[2207552]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-24 15:13:09 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:45353: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-24 15:14:11 dovecot_login authenticator failed for H=([103.251.31.154]) [103.251.31.154]:53556: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-24 15:13:23 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:55092: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-12-24 15:19:23 dovecot_login authenticator failed for H=(177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:34224: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-24 15:19:45 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:37330: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 15:22:33 host2 sshd[2216039]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-24 15:25:49 dovecot_login authenticator failed for H=host-89-242-182-159.as13285.net [89.242.182.159]:48909: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-24 15:26:14 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:57445: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.64.121
country_id: 6252001
description:
[2025-12-24 15:28:15 +0530] info [cpaneld] 72.80.64.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.196.96.136
country_id: 6252001
description:
[2025-12-24 15:28:16 +0530] info [cpaneld] 74.196.96.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.7.28
country_id: 6252001
description:
[2025-12-24 15:28:18 +0530] info [cpaneld] 23.243.7.28 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.26.104.122
country_id: 6252001
description:
[2025-12-24 15:28:20 +0530] info [whostmgrd] 98.26.104.122 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 24 15:28:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<oIUZta9GEMojygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-24 15:28:54 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:48978: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.250.173.134
country_id: 6252001
description:
[2025-12-24 15:28:22 +0530] info [cpaneld] 172.250.173.134 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.239.242.32
country_id: 6252001
description:
[2025-12-24 15:28:25 +0530] info [cpaneld] 141.239.242.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.171.142
country_id: 6252001
description:
[2025-12-24 15:28:23 +0530] info [cpaneld] 104.32.171.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2025-12-24 15:28:36 dovecot_login authenticator failed for H=([49.124.152.234]) [49.124.152.234]:43186: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:34:27 host2 sshd[2224979]: Disconnected from invalid user lisa 193.70.86.193 port 49924 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.27.196.241
country_id: 6252001
description:
[2025-12-24 15:36:43 +0530] info [cpaneld] 50.27.196.241 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.139.15
country_id: 6252001
description:
[2025-12-24 15:36:45 +0530] info [cpaneld] 45.31.139.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.11.4.19
country_id: 6252001
description:
[2025-12-24 15:36:48 +0530] info [cpaneld] 100.11.4.19 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-24 15:37:03 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:38021: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-24 15:36:22 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:59490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.128.42.219
country_id: 6252001
description:
[2025-12-24 15:36:44 +0530] info [whostmgrd] 107.128.42.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.67.162.134
country_id: 6252001
description:
[2025-12-24 15:36:47 +0530] info [cpaneld] 71.67.162.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:36:27 host2 sshd[2226533]: Disconnected from invalid user git 205.185.126.121 port 52820 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.208.87.26
country_id: 6252001
description:
[2025-12-24 15:36:38 +0530] info [cpaneld] 72.208.87.26 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.59.225.11
country_id: 6252001
description:
[2025-12-24 15:36:40 +0530] info [cpaneld] 174.59.225.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.48
country_id: 1733045
description:
2025-12-24 15:37:44 dovecot_login authenticator failed for H=([49.124.151.48]) [49.124.151.48]:32852: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 24 15:38:21 host2 sshd[2227938]: Disconnected from invalid user git 118.193.39.127 port 44956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-24 15:39:14 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:36536: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-24 15:40:05 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:52682: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:39:44 host2 sshd[2228921]: Disconnected from invalid user testuser1 193.70.86.193 port 40176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:39:49 host2 sshd[2229018]: Disconnected from invalid user finance 205.185.126.121 port 36498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:40:39 host2 sshd[2230164]: Disconnected from invalid user gituser 155.248.164.42 port 56690 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.137.56.185
country_id: 6252001
description:
[2025-12-24 15:40:22 +0530] info [cpaneld] 75.137.56.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.132.239.233
country_id: 6252001
description:
[2025-12-24 15:40:21 +0530] info [cpaneld] 99.132.239.233 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.29.184.39
country_id: 6252001
description:
[2025-12-24 15:40:26 +0530] info [whostmgrd] 96.29.184.39 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.218.78.4
country_id: 6252001
description:
[2025-12-24 15:40:31 +0530] info [cpaneld] 32.218.78.4 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 15:41:07 host2 pure-ftpd[2230543]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.150.35
country_id: 6252001
description:
[2025-12-24 15:40:24 +0530] info [cpaneld] 45.50.150.35 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.189.84.53
country_id: 6252001
description:
[2025-12-24 15:40:27 +0530] info [cpaneld] 99.189.84.53 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.96.110.65
country_id: 6252001
description:
[2025-12-24 15:40:29 +0530] info [cpaneld] 98.96.110.65 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-24 15:40:23 dovecot_login authenticator failed for H=([182.95.24.209]) [182.95.57.158]:53040: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Dec 24 15:41:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.11, lip=66.85.158.92, session=<rCCh4a9GT+pb51kL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:41:53 host2 sshd[2230892]: Disconnected from invalid user victor 189.50.142.82 port 44413 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:42:13 host2 sshd[2231252]: Disconnected from invalid user john 205.185.126.121 port 34730 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Dec 24 15:41:33 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.11, lip=66.85.158.92, session=<Sh174q9GO4Bb51kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.14
country_id: 3017382
description:
Dec 24 15:41:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.14, lip=66.85.158.92, session=<rlKt4q9G051b51kO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:41:58 host2 sshd[2230962]: Disconnected from invalid user jose 193.70.86.193 port 38810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:41:27 host2 sshd[2230697]: Disconnected from invalid user asd 193.70.86.193 port 33710 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.134
country_id: 3017382
description:
Dec 24 15:41:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.134, lip=66.85.158.92, session=</9BG4q9Gmcpb51mG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:42:41 host2 sshd[2231578]: Disconnected from invalid user asd 155.248.164.42 port 40856 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:43:19 host2 sshd[2232042]: Disconnected from invalid user seedbox 155.248.164.42 port 34488 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.115.225.163
country_id: 6252001
description:
[2025-12-24 15:44:12 +0530] info [cpaneld] 172.115.225.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.190.217.190
country_id: 6252001
description:
[2025-12-24 15:44:13 +0530] info [whostmgrd] 68.190.217.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.42.7.86
country_id: 6252001
description:
[2025-12-24 15:44:16 +0530] info [cpaneld] 73.42.7.86 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.35.177.21
country_id: 6252001
description:
[2025-12-24 15:44:06 +0530] info [cpaneld] 98.35.177.21 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.52.149.226
country_id: 6252001
description:
[2025-12-24 15:44:10 +0530] info [cpaneld] 170.52.149.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.106.39.203
country_id: 6252001
description:
[2025-12-24 15:44:15 +0530] info [cpaneld] 99.106.39.203 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.89.244.47
country_id: 6252001
description:
[2025-12-24 15:44:18 +0530] info [cpaneld] 167.89.244.47 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.34.105.190
country_id: 6252001
description:
[2025-12-24 15:45:27 +0530] info [cpaneld] 104.34.105.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.213.132.158
country_id: 6252001
description:
[2025-12-24 15:45:29 +0530] info [cpaneld] 107.213.132.158 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.49.41
country_id: 6252001
description:
[2025-12-24 15:45:32 +0530] info [cpaneld] 98.97.49.41 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.218.163
country_id: 6252001
description:
[2025-12-24 15:45:30 +0530] info [whostmgrd] 76.170.218.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.254.83.71
country_id: 6252001
description:
[2025-12-24 15:45:35 +0530] info [cpaneld] 142.254.83.71 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.183.252.199
country_id: 6252001
description:
[2025-12-24 15:45:36 +0530] info [cpaneld] 71.183.252.199 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.199.22.11
country_id: 6252001
description:
[2025-12-24 15:45:26 +0530] info [cpaneld] 98.199.22.11 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.95.173.102
country_id: 6251999
description:
Dec 24 15:46:39 host2 pure-ftpd[2234697]: (?@38.95.173.102) [INFO] New connection from 38.95.173.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.163
country_id: 3996063
description:
2025-12-24 15:46:52 dovecot_login authenticator failed for H=(201.172.88.163-clientes-izzi.mx) [201.172.88.163]:42542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-24 15:47:05 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:50784: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 24 15:48:21 host2 sshd[2237157]: Disconnected from invalid user seedbox 118.193.39.127 port 46980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:49:24 host2 sshd[2238701]: Disconnected from invalid user uftp 189.50.142.82 port 53358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:52:24 host2 sshd[2243029]: Disconnected from invalid user ftpuser 189.50.142.82 port 39256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-24 15:55:11 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:47646: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-12-24 15:55:15 dovecot_login authenticator failed for H=1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:59584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-24 15:55:23 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:39730: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-24 15:55:34 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:35112: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-24 15:58:07 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:53396: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.88.178.214
country_id: 6252001
description:
[2025-12-24 15:59:26 +0530] info [webmaild] 166.88.178.214 - info@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 24 16:04:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<NRu/MrBGEojBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-24 16:14:25 dovecot_login authenticator failed for H=([128.185.229.126]) [128.185.229.126]:51862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.125
country_id: 3469034
description:
Dec 24 16:14:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=177.44.96.125, lip=66.85.158.91, TLS, session=<XfcOWLBGxMqxLGB9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.23
country_id: 690791
description:
Dec 24 16:15:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.25.23, lip=66.85.158.91, TLS, session=<GwE+WbBGVYWwZxkX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-12-24 16:15:04 dovecot_login authenticator failed for H=177-72-87-7.static.as262543.net.br [177.72.87.7]:34212: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-24 16:15:22 dovecot_plain authenticator failed for H=ool-457bdb52.dyn.optonline.net (ozoaccal) [69.123.219.82]:59894: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-24 16:18:36 dovecot_login authenticator failed for H=wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:56095: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-24 16:19:34 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (sphooded) [174.169.224.27]:40190: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.160
country_id: 3469034
description:
Dec 24 16:19:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=191.53.128.160, lip=66.85.158.91, TLS, session=<aUIbarBGSc+/NYCg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.0.14.108
country_id: 6252001
description:
[2025-12-24 16:18:56 +0530] info [cpaneld] 142.0.14.108 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.145.86.81
country_id: 6252001
description:
[2025-12-24 16:18:58 +0530] info [cpaneld] 104.145.86.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.101.255
country_id: 6252001
description:
[2025-12-24 16:19:04 +0530] info [cpaneld] 76.171.101.255 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-12-24 16:19:04 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com [203.198.173.137]:42790: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.219
country_id: 3469034
description:
Dec 24 16:19:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=187.120.73.219, lip=66.85.158.91, TLS, session=<b97oaLBG6827eEnb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.57.233.30
country_id: 6252001
description:
[2025-12-24 16:19:00 +0530] info [cpaneld] 99.57.233.30 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.165.130.42
country_id: 6252001
description:
[2025-12-24 16:19:02 +0530] info [cpaneld] 24.165.130.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.173.30
country_id: 6252001
description:
[2025-12-24 16:19:01 +0530] info [whostmgrd] 173.68.173.30 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.139.193.81
country_id: 6252001
description:
[2025-12-24 16:19:03 +0530] info [cpaneld] 35.139.193.81 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 288 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.57
country_id: 6252001
description:
Dec 24 16:25:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.97.26.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1SSWgLBGqtwSYRo5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.57
country_id: 6252001
description:
Dec 24 16:25:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.26.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Tmb7gLBG4sgSYRo5>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 315 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.157.5
country_id: 6252001
description:
[2025-12-24 16:29:01 +0530] info [cpaneld] 24.4.157.5 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.193.155.156
country_id: 6252001
description:
[2025-12-24 16:29:21 +0530] info [cpaneld] 216.193.155.156 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.254.4.112
country_id: 6252001
description:
[2025-12-24 16:29:24 +0530] info [whostmgrd] 73.254.4.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.244.230.48
country_id: 6252001
description:
[2025-12-24 16:29:27 +0530] info [cpaneld] 71.244.230.48 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.85.101.131
country_id: 6252001
description:
[2025-12-24 16:29:00 +0530] info [cpaneld] 69.85.101.131 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.135.246.242
country_id: 6252001
description:
[2025-12-24 16:29:08 +0530] info [cpaneld] 207.135.246.242 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.235.110.127
country_id: 6252001
description:
[2025-12-24 16:29:31 +0530] info [cpaneld] 98.235.110.127 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.234.166.119
country_id: 6252001
description:
[2025-12-24 16:29:02 +0530] info [whostmgrd] 73.234.166.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.206.18
country_id: 6252001
description:
[2025-12-24 16:29:03 +0530] info [cpaneld] 35.150.206.18 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.38.222.116
country_id: 6252001
description:
[2025-12-24 16:29:20 +0530] info [cpaneld] 100.38.222.116 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.180.57.121
country_id: 6252001
description:
[2025-12-24 16:29:23 +0530] info [cpaneld] 24.180.57.121 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.188.204.197
country_id: 6252001
description:
[2025-12-24 16:28:56 +0530] info [cpaneld] 65.188.204.197 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.130.72.50
country_id: 6252001
description:
[2025-12-24 16:29:06 +0530] info [cpaneld] 107.130.72.50 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.46.29.69
country_id: 6252001
description:
[2025-12-24 16:29:29 +0530] info [cpaneld] 74.46.29.69 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.215.166
country_id: 6252001
description:
[2025-12-24 16:31:16 +0530] info [cpaneld] 73.235.215.166 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.247.205
country_id: 6252001
description:
[2025-12-24 16:31:17 +0530] info [cpaneld] 23.243.247.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.121.242.186
country_id: 6252001
description:
[2025-12-24 16:31:19 +0530] info [whostmgrd] 70.121.242.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.117.116.46
country_id: 6252001
description:
[2025-12-24 16:31:18 +0530] info [cpaneld] 23.117.116.46 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.51.38.144
country_id: 6252001
description:
[2025-12-24 16:31:20 +0530] info [cpaneld] 75.51.38.144 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.242.170
country_id: 6252001
description:
[2025-12-24 16:31:21 +0530] info [cpaneld] 47.147.242.170 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.165.193
country_id: 6252001
description:
[2025-12-24 16:31:22 +0530] info [cpaneld] 67.188.165.193 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:39:44 host2 sshd[2293776]: Disconnected from invalid user miguel 51.222.106.104 port 58166 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.19.186
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.19.186: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:40:35 host2 sshd[2295120]: Disconnected from invalid user build 103.118.114.22 port 39692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:42:09 host2 sshd[2296819]: Disconnected from invalid user samba 51.222.106.104 port 56622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:42:35 host2 sshd[2297208]: Disconnected from invalid user appltest 163.181.207.222 port 49250 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 16:43:43 host2 pure-ftpd[2298314]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:43:57 host2 sshd[2298597]: Disconnected from invalid user ubuntu 103.118.114.22 port 39144 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 322 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:45:07 host2 sshd[2299724]: Disconnected from invalid user tars 51.222.106.104 port 55622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:45:47 host2 sshd[2300310]: Disconnected from invalid user teaspeak 167.71.128.40 port 60500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:46:20 host2 sshd[2301188]: Disconnected from invalid user samba 167.71.128.40 port 56272 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:47:21 host2 sshd[2302049]: Received disconnect from 167.71.128.40 port 36876:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:47:21 host2 sshd[2302049]: Disconnected from invalid user ftpuser 167.71.128.40 port 36876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 24 16:47:32 host2 sshd[2302203]: Disconnected from invalid user spooler 199.195.254.215 port 56536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 24 16:47:56 host2 sshd[2302520]: Disconnected from invalid user test 20.102.116.25 port 43546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:48:14 host2 sshd[2302857]: Disconnected from invalid user gopal 163.181.207.222 port 39076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:48:28 host2 sshd[2303060]: Disconnected from invalid user raaj 103.118.114.22 port 38236 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 24 16:48:31 host2 sshd[2303157]: Disconnected from invalid user tin 20.102.116.25 port 43984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:48:49 host2 sshd[2303443]: Disconnected from invalid user hoster 167.71.128.40 port 53346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:49:09 host2 sshd[2303872]: Disconnected from invalid user tin 163.181.207.222 port 39410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:50:29 host2 sshd[2305228]: Disconnected from invalid user nasrin 163.181.207.222 port 35636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 24 16:50:00 host2 sshd[2304637]: Disconnected from invalid user oracle 213.6.203.226 port 38443 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.79.63
country_id: 6252001
description:
Dec 24 16:50:57 host2 sshd[2305728]: Disconnected from invalid user wm 146.190.79.63 port 42934 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.79.63
country_id: 6252001
description:
Dec 24 16:51:29 host2 sshd[2306459]: Disconnected from invalid user admin 146.190.79.63 port 36700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:51:39 host2 sshd[2306620]: Disconnected from invalid user j 51.222.106.104 port 46874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 24 16:52:42 host2 sshd[2307380]: Disconnected from invalid user wahyu 213.6.203.226 port 61476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:53:20 host2 sshd[2307947]: Disconnected from invalid user wm 163.181.207.222 port 50640 [preauth]


