# incident

plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:29:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-01-31  4:29:31 11216 [Warning] Aborted connection 11216 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:29:03 dovecot_login authenticator failed for H=(amMkE1BGq) [178.16.54.22]:63530: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-31 04:30:13 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:41165: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68252.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:03306d75f8c59ceb897a5f4da48e02c5f4183c0c||Title:0xbe0e4419||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:30:12 dovecot_login authenticator failed for H=(SI6slO) [178.16.54.22]:65285: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.8
country_id: 732800
description:
2026-01-31 04:30:32 dovecot_login authenticator failed for H=(ADMIN) [94.156.14.8]:54650: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.91.5
country_id: 1269750
description:
2026-01-31 04:30:37 dovecot_login authenticator failed for H=(abts-tn-static-005.91.165.122.airtelbroadband.in) [122.165.91.5]:53945: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:30:01 dovecot_login authenticator failed for H=(MiwZUK) [185.230.124.69]:56841: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:30:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31  4:31:35 11425 [Warning] Aborted connection 11425 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:31:22 dovecot_login authenticator failed for H=(oD6xOz) [185.230.124.69]:59985: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:31:30 dovecot_login authenticator failed for H=(0bRlBsBf) [178.16.54.22]:51180: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:31:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:31:15 dovecot_login authenticator failed for H=(cG18fFa) [185.230.124.69]:49596: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:32:02 dovecot_login authenticator failed for H=(T7sgp3) [178.16.54.22]:63470: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:32:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:32:07 dovecot_login authenticator failed for H=(iNJ89R5O5) [185.230.124.69]:60630: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.159.175.91
country_id: 2464461
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=20 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:32:57 dovecot_login authenticator failed for H=(Kj1XG6) [185.230.124.69]:64368: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.27.8
country_id: 1835841
description:
2026-01-31 04:33:32 dovecot_login authenticator failed for H=(devserver.gaonsoft.com) [118.39.27.8]:37428: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-31 04:33:40 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:48934: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:33:02 dovecot_login authenticator failed for H=(Iu7S9n) [185.230.124.69]:54411: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: kdiballoon.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/kdiballo1/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:33:13 dovecot_login authenticator failed for H=(sP01RbZ) [178.16.54.22]:54739: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:33:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.61.55
country_id: 1269750
domain: tst-ma.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:97735.tst-ma.com||ServerName:tst-ma.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d5f39238070838d3b1390c1351084d18fd224b14||Title:0x6fe13822||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-31 04:34:37 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:41512: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-31 04:34:48 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:47210: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:34:14 dovecot_login authenticator failed for H=(vUcVx2sv) [185.230.124.69]:51497: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:34:20 dovecot_login authenticator failed for H=(1rhmrT) [178.16.54.22]:50321: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:34:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:34:33 dovecot_login authenticator failed for H=(Ub7BjZ98) [185.230.124.69]:57827: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:35:57 dovecot_login authenticator failed for H=(TNkeXsl) [185.230.124.69]:59399: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:35:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-31 04:35:57 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:36960: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:35:03 dovecot_login authenticator failed for H=(uGQR8YJT3e) [185.230.124.69]:64069: 535 Incorrect authentication data (set_id=finance@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:35:11 dovecot_login authenticator failed for H=(lr4WvCsB) [178.16.54.22]:56540: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2026-01-31 04:35:29 dovecot_login authenticator failed for H=sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:64475: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77093094
abuser: 194.163.133.180
country_id: 3017382
domain: inter-link.edu.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((44723*43971))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:36:07 dovecot_login authenticator failed for H=(kAmWsNg) [185.230.124.69]:62299: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:36:16 dovecot_login authenticator failed for H=(Reu02Y4a) [178.16.54.22]:62384: 535 Incorrect authentication data (set_id=paul.wong)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.232.214
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=348656 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:36:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:37:03 dovecot_login authenticator failed for H=(oTqGTqf01s) [178.16.54.22]:60848: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:37:21 dovecot_login authenticator failed for H=(ILf9gwZ) [185.230.124.69]:50269: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:37:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:37:02 dovecot_login authenticator failed for H=(aB5W63rk9K) [185.230.124.69]:64798: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:38:05 dovecot_login authenticator failed for H=(9mVtZwX) [185.230.124.69]:60524: 535 Incorrect authentication data (set_id=finance@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.70.186.174
country_id: 2077456
domain: mail.ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/mschemic/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:38:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@manforce.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:38:10 dovecot_login authenticator failed for H=(vy1IxT) [178.16.54.22]:54157: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:39:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:39:21 dovecot_login authenticator failed for H=(GZB4d6iM8) [185.230.124.69]:54492: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:39:23 dovecot_login authenticator failed for H=(q2jkxZe6) [185.230.124.69]:50352: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.9
country_id: 6252001
description:
2026-01-31 04:39:34 dovecot_plain authenticator failed for H=([192.159.99.9]) [192.159.99.9]:63214: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.9
country_id: 6252001
description:
2026-01-31 04:40:05 dovecot_plain authenticator failed for H=([192.159.99.9]) [192.159.99.9]:50799: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:40:05 dovecot_login authenticator failed for H=(fOOSV93) [185.230.124.69]:63752: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-31 04:40:50 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:38198: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/m.me/images/article.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:40:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:40:07 dovecot_login authenticator failed for H=(ipLWvT8oKs) [178.16.54.22]:51091: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:41:12 dovecot_login authenticator failed for H=(yTnX08) [185.230.124.69]:57198: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:41:17 dovecot_login authenticator failed for H=(TyOc7K7h) [178.16.54.22]:51511: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:41:25 dovecot_login authenticator failed for H=(e8NfCq) [185.230.124.69]:52510: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2026-01-31 04:41:46 dovecot_login authenticator failed for H=([101.168.17.20]) [101.168.17.20]:35128: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.86.55
country_id: 1814991
description:
2026-01-31 04:41:13 dovecot_login authenticator failed for H=([14.20.86.55]) [14.20.86.55]:40760: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:41:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:42:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.122.253
country_id: 1643084
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78961514527453 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2026-01-31 04:42:07 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [151.237.115.208]:50277: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:42:21 dovecot_login authenticator failed for H=(a1r3ZG) [178.16.54.22]:57854: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:42:17 dovecot_login authenticator failed for H=(Tut6WP) [185.230.124.69]:50130: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:43:26 dovecot_login authenticator failed for H=(E01slOZWgS) [185.230.124.69]:53301: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:43:30 dovecot_login authenticator failed for H=(qK0l96tN) [178.16.54.22]:53377: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:43:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:43:05 dovecot_login authenticator failed for H=(m0W1WE) [185.230.124.69]:49361: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:44:00 dovecot_login authenticator failed for H=(WXELCsOqS) [185.230.124.69]:52115: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:44:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:44:21 dovecot_login authenticator failed for H=(ulXxEBM) [178.16.54.22]:52377: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:45:16 dovecot_login authenticator failed for H=(InNrZqPuu) [178.16.54.22]:63750: 535 Incorrect authentication data (set_id=paul.wong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.63.18
country_id: 1814991
description:
2026-01-31 04:45:46 dovecot_login authenticator failed for H=([114.98.63.18]) [114.98.63.18]:38282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:45:15 dovecot_login authenticator failed for H=(HMSBtGeCrz) [185.230.124.69]:53247: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:45:03 dovecot_login authenticator failed for H=(eJB8XE) [185.230.124.69]:63599: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.102.251.21
country_id: 3469034
description:
[2026-01-31 04:45:22 +0800] info [webmaild] 149.102.251.21 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-31 04:45:36 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:57775: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:45:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:46:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:46:10 dovecot_login authenticator failed for H=(621dVi) [178.16.54.22]:51723: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.58
country_id: 1668284
description:
2026-01-31 04:46:46 dovecot_login authenticator failed for H=110-25-109-58.adsl.fetnet.net [110.25.109.58]:37805: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:46:09 dovecot_login authenticator failed for H=(fULhLyrIq) [185.230.124.69]:61620: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.163.246.249
country_id: 3469034
domain: u-net.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30242.u-net.com.my||ServerName:u-net.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba414ce25f6830dc6815a3eb05822bfcaa150b21||Title:0x0a771642||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:47:06 dovecot_login authenticator failed for H=(xbNfkwj) [185.230.124.69]:61343: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:47:12 dovecot_login authenticator failed for H=(j6y5CG) [185.230.124.69]:61381: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:47:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.211.84.153
country_id: 1814991
description:
2026-01-31 04:47:07 dovecot_login authenticator failed for H=([171.211.123.106]) [171.211.84.153]:41610: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 37.19.223.237
country_id: 2782113
domain: visoft.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/contact-from.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:47:01 dovecot_login authenticator failed for H=(HXiBHiKp) [178.16.54.22]:55052: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:48:03 dovecot_login authenticator failed for H=(gruZOJi) [178.16.54.22]:62090: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:48:11 dovecot_login authenticator failed for H=(7lGiyfwLr) [185.230.124.69]:52660: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:48:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 165.99.40.161
country_id: 1168579
domain: u-net.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55926.u-net.com.my||ServerName:u-net.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30a127deeac57809cbcd552aa74856fa21787a7e||Title:0xf797515b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:49:28 dovecot_login authenticator failed for H=(ikK0LjAYMT) [185.230.124.69]:56581: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.67
country_id: 1733045
description:
2026-01-31 04:49:51 dovecot_login authenticator failed for H=([49.124.151.67]) [49.124.151.67]:39746: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-31 04:49:58 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:57840: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:49:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:49:03 dovecot_login authenticator failed for H=(r8gaR4i4RQ) [185.230.124.69]:61124: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:49:23 dovecot_login authenticator failed for H=(WvvvqLPmlP) [178.16.54.22]:60042: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-31 04:49:44 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:47189: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/oxboldc/public_html/assets/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-01-31 04:50:06 dovecot_login authenticator failed for H=([38.141.252.55]) [38.141.252.55]:60636: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:50:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:50:20 dovecot_login authenticator failed for H=(MYAyKdSF4X) [185.230.124.69]:59651: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:50:08 dovecot_login authenticator failed for H=(76aKe4TR) [178.16.54.22]:49876: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.135.160.94
country_id: 6252001
description:
[2026-01-31 04:50:31 +0800] info [whostmgrd] 47.135.160.94 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/oxboldc/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:51:26 dovecot_login authenticator failed for H=(B7nYaydF) [178.16.54.22]:54132: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:51:25 dovecot_login authenticator failed for H=(E0JPuDfeGE) [185.230.124.69]:60116: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:51:07 dovecot_login authenticator failed for H=(Y0c0ZwAdZ9) [185.230.124.69]:61914: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.50.202
country_id: 1814991
description:
2026-01-31 04:51:12 dovecot_login authenticator failed for H=([219.144.50.202]) [219.144.50.202]:40007: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-31 04:51:22 dovecot_login authenticator failed for H=([125.61.36.27]) [125.61.48.234]:60418: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:51:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:52:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:52:24 dovecot_login authenticator failed for H=(aPzfZsZkr) [178.16.54.22]:56033: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:52:15 dovecot_login authenticator failed for H=(cF3sGW) [185.230.124.69]:51591: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:53:01 dovecot_login authenticator failed for H=(2g1AJy4ht) [178.16.54.22]:59245: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:53:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:53:06 dovecot_login authenticator failed for H=(xbFlXddBOC) [185.230.124.69]:53088: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:53:11 dovecot_login authenticator failed for H=(f2lDYyFQ) [185.230.124.69]:50582: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:54:03 dovecot_login authenticator failed for H=(8165Ui) [185.230.124.69]:51983: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-31 04:54:16 dovecot_login authenticator failed for H=(nsg-corporate-25.230.186.122.airtel.in) [125.19.161.150]:42308: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.3.26
country_id: 6252001
description:
[2026-01-31 04:54:24 +0800] info [whostmgrd] 172.58.3.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-31 04:54:56 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:60164: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:54:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:54:08 dovecot_login authenticator failed for H=(VHSv9I8oil) [178.16.54.22]:54118: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.49.217.205
country_id: 1814991
description:
2026-01-31 04:54:40 dovecot_login authenticator failed for H=([112.49.217.205]) [112.49.217.205]:60542: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-31 04:54:23 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:36332: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.69.211
country_id: 3865483
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/teletech-at-home-employee-reviews HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.69.211
country_id: 3865483
domain: tujusetia.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.myhttp/tujusetia.my/teletech-at-home-employee-reviews HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:55:01 dovecot_login authenticator failed for H=(LAMk5El) [178.16.54.22]:53277: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:55:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.16.88
country_id: 2661886
description:
2026-01-31 04:55:27 dovecot_login authenticator failed for H=a088.broadband.quicknet.se [217.78.16.88]:56122: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:55:09 dovecot_login authenticator failed for H=(F5Sw7uwe) [185.230.124.69]:57808: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 140.179.148.12
country_id: 1814991
domain: www.box.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.39.199
country_id: 6252001
description:
2026-01-31 04:55:34 dovecot_login authenticator failed for H=(ADMIN) [156.146.39.199]:32798: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-31 04:55:38 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:58198: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:55:07 dovecot_login authenticator failed for H=(4u8t6TKw) [185.230.124.69]:62671: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:56:03 dovecot_login authenticator failed for H=(ibDpzIOTG) [185.230.124.69]:65446: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:56:08 dovecot_login authenticator failed for H=(C1yEVPwn3) [178.16.54.22]:63010: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:56:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.98
country_id: 1269750
description:
2026-01-31 04:56:46 dovecot_login authenticator failed for H=([125.23.183.98]) [125.23.183.98]:52496: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.214.18
country_id: 1814991
description:
2026-01-31 04:56:31 dovecot_login authenticator failed for H=([218.13.214.18]) [218.13.214.18]:55290: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-31 04:57:52 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:44036: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-31 04:57:07 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:56002: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:57:20 dovecot_login authenticator failed for H=(EMQ2UXz3k) [185.230.124.69]:58778: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.39.245
country_id: 2510769
description:
2026-01-31 04:57:28 dovecot_login authenticator failed for H=245.red-88-11-39.dynamicip.rima-tde.net [88.11.39.245]:57124: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:57:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:57:09 dovecot_login authenticator failed for H=(oYrpfEYIU) [185.230.124.69]:52021: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.249.20.14
country_id: 1814991
description:
2026-01-31 04:57:30 dovecot_login authenticator failed for H=([140.249.20.14]) [140.249.20.14]:35649: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:57:32 dovecot_login authenticator failed for H=(tfcJc9AM) [178.16.54.22]:61676: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-31 04:58:19 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (pillhemed) [174.169.224.27]:57994: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:58:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:58:07 dovecot_login authenticator failed for H=(f7XHHYC) [178.16.54.22]:64198: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:58:10 dovecot_login authenticator failed for H=(A1TBP7X) [185.230.124.69]:50102: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.138.250
country_id: 1814991
description:
2026-01-31 04:58:40 dovecot_login authenticator failed for H=([222.173.138.250]) [222.173.138.250]:50560: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:58:54 dovecot_login authenticator failed for H=(INGyHK) [185.230.124.69]:57641: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.220.228
country_id: 3865483
domain: tujusetia.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.myhttp/tujusetia.my/2016/04/04/admission-application-and-academic-essays-7/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 04:58:23 dovecot_login authenticator failed for H=(OakrXDtT) [178.16.54.138]:53751: 535 Incorrect authentication data (set_id=kywong.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-31 04:58:29 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:38485: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.220.228
country_id: 3865483
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/2016/04/04/admission-application-and-academic-essays-7/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:59:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:59:03 dovecot_login authenticator failed for H=(OlhdXB8IhV) [185.230.124.69]:55664: 535 Incorrect authentication data (set_id=finance@vc-b.com.my)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 142.111.72.239
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block URI containing malicious URLs||RSV:7.71||T:APACHE||MVN:ARGS:url||SC:/home2/agsaintifik/public_html/wp-comments-post.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.16.171.138
country_id: 6252001
description:
[2026-01-31 05:00:32 +0800] info [whostmgrd] 47.16.171.138 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:00:02 dovecot_login authenticator failed for H=(qd0q9k) [178.16.54.22]:62218: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:00:07 dovecot_login authenticator failed for H=(qGYMxt) [185.230.124.69]:56733: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
country_id: 2635167
description:
2026-01-31  5:00:46 15369 [Warning] Aborted connection 15369 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:00:52 dovecot_login authenticator failed for H=(uyojjC) [185.230.124.69]:64107: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:00:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:01:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
country_id: 2635167
description:
2026-01-31  5:01:08 15387 [Warning] Aborted connection 15387 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.171
country_id: 1814991
description:
2026-01-31 05:01:10 dovecot_login authenticator failed for H=([111.57.17.171]) [111.57.17.171]:41426: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:01:08 dovecot_login authenticator failed for H=(C6qkoATRNS) [185.230.124.69]:52537: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:01:18 dovecot_login authenticator failed for H=(LLVZQW8I4N) [178.16.54.22]:63660: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
country_id: 1814991
description:
2026-01-31 05:01:59 dovecot_login authenticator failed for H=([116.7.248.50]) [116.7.248.50]:52449: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 05:01:24 dovecot_login authenticator failed for H=([187.7.85.97]) [201.15.149.254]:37014: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:02:01 dovecot_login authenticator failed for H=(IpO82pgRLq) [185.230.124.69]:57947: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:02:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-31 05:02:37 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:51636: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.188.62.49
country_id: 3017382
domain: autodiscover.mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:02:50 dovecot_login authenticator failed for H=(gKYGha8) [185.230.124.69]:61084: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:02:19 dovecot_login authenticator failed for H=(WHsGVHw) [178.16.54.22]:55679: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:03:07 dovecot_login authenticator failed for H=(oMZ7E4) [178.16.54.22]:54573: 535 Incorrect authentication data (set_id=paul.wong)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.51
country_id: 6252001
domain: www.lvconsult.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.70 Safari/537.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:03:09 dovecot_login authenticator failed for H=(RGTUVqj) [185.230.124.69]:54250: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.212.116
country_id: 1269750
domain: urban.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13909.urban.my||ServerName:urban.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb3147253d22e7950d0d610a66f4c2da261cfc12||Title:0xf83bef23||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.188.62.49
country_id: 3017382
domain: autodiscover.mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:03:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2026-01-31 05:04:02 dovecot_login authenticator failed for H=(host-232.185.15.189.0.0xffffff00.sterling.stercom.ru) [185.15.189.232]:52130: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.233.5.67
country_id: 6252001
description:
2026-01-31 05:04:12 dovecot_login authenticator failed for H=([50.233.5.67]) [50.233.5.67]:54744: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:04:19 dovecot_login authenticator failed for H=(Y0VXT7q) [178.16.54.22]:58878: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:04:19 dovecot_login authenticator failed for H=(o7diS57H) [185.230.124.69]:58142: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:04:44 dovecot_login authenticator failed for H=(c0wApn) [185.230.124.69]:64456: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.237.4.60
country_id: 6252001
description:
[2026-01-31 05:04:57 +0800] info [whostmgrd] 71.237.4.60 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:04:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.194
country_id: 1835841
description:
2026-01-31 05:05:24 dovecot_login authenticator failed for H=([119.205.188.194]) [119.205.188.194]:46834: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:05:10 dovecot_login authenticator failed for H=(OXUqwSdpVM) [185.230.124.69]:56790: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.162
country_id: 1269750
description:
2026-01-31 05:05:26 dovecot_login authenticator failed for H=(033.162.18.125.dhcp.anaronline.net) [125.19.248.162]:53772: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:05:33 dovecot_login authenticator failed for H=(eFVpExchlQ) [178.16.54.22]:62856: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:05:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2026-01-31 05:05:37 dovecot_login authenticator failed for H=(223-197-145-114.static.imsbiz.com) [223.197.145.114]:62568: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:06:02 dovecot_login authenticator failed for H=(8Hs4VOLu) [185.230.124.69]:54324: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:06:38 dovecot_login authenticator failed for H=(F7t7dNA3) [178.16.54.22]:50147: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:06:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:06:36 dovecot_login authenticator failed for H=(QRMEFXKIRp) [185.230.124.69]:57979: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-31 05:06:59 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:51480: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.33
country_id: 1733045
description:
2026-01-31 05:06:45 dovecot_login authenticator failed for H=([49.124.153.33]) [49.124.153.33]:34792: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:07:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/printspecsolutio/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:07:19 dovecot_login authenticator failed for H=(Cskg1l0TyP) [178.16.54.22]:52958: 535 Incorrect authentication data (set_id=paul.wong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.17.249.103
country_id: 6252001
description:
[2026-01-31 05:07:16 +0800] info [whostmgrd] 174.17.249.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-01-31 05:07:35 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:48698: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:07:02 dovecot_login authenticator failed for H=(MqZ6LEPB) [185.230.124.69]:62951: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.247
country_id: 1605651
description:
2026-01-31 05:07:09 dovecot_login authenticator failed for H=([203.170.150.247]) [203.170.150.247]:49532: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:08:16 dovecot_login authenticator failed for H=(ZAKCP3nB) [185.230.124.69]:59768: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:08:30 dovecot_login authenticator failed for H=(oeytI4oM4z) [178.16.54.22]:62440: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:08:09 dovecot_login authenticator failed for H=(KYM3hV0) [185.230.124.69]:49905: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.199.247.219
country_id: 6252001
description:
[2026-01-31 05:09:03 +0800] info [whostmgrd] 47.199.247.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:09:07 dovecot_login authenticator failed for H=(8ddHz0) [185.230.124.69]:60482: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:09:16 dovecot_login authenticator failed for H=(nTsy9pio) [178.16.54.138]:57108: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:09:35 dovecot_login authenticator failed for H=(8iFkXm) [178.16.54.22]:62960: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:09:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:10:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:10:24 dovecot_login authenticator failed for H=(LbBtgWySvU) [185.230.124.69]:59549: 535 Incorrect authentication data (set_id=finance)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:10:09 dovecot_login authenticator failed for H=(Vq7hQrUc6T) [178.16.54.22]:59711: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:10:15 dovecot_login authenticator failed for H=(rNY3kj) [178.16.54.138]:57747: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:10:10 dovecot_login authenticator failed for H=(Ocl6Ntz2Ez) [185.230.124.69]:49987: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:11:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:11:14 dovecot_login authenticator failed for H=(zaA4pyzOq) [185.230.124.69]:52768: 535 Incorrect authentication data (set_id=finance)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.204.132.124
country_id: 1269750
domain: usfood.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87916.usfood.com.my||ServerName:usfood.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b590e8731eb5de037d401d77c006f3c96571d4e||Title:0x4dcc5b01||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 05:11:37 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:47766: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2026-01-31 05:11:51 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:39409: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:11:11 dovecot_login authenticator failed for H=(aB1VYX) [178.16.54.138]:55489: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:11:35 dovecot_login authenticator failed for H=(Jl4jR9Y) [178.16.54.22]:57803: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:12:04 dovecot_login authenticator failed for H=(fd90UEa) [185.230.124.69]:51637: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:12:16 dovecot_login authenticator failed for H=(eMC4tL) [178.16.54.138]:53628: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:12:10 dovecot_login authenticator failed for H=(nB7tVJT) [178.16.54.22]:51640: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/ajpl3424/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:12:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:12:04 dovecot_login authenticator failed for H=(wrUWHFJpX) [185.230.124.69]:55707: 535 Incorrect authentication data (set_id=finance)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/commercial-office.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:13:17 dovecot_login authenticator failed for H=(JEyRFjMS) [178.16.54.138]:54299: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:13:07 dovecot_login authenticator failed for H=(wImhB4) [185.230.124.69]:60957: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:13:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:13:20 dovecot_login authenticator failed for H=(rUAmmB) [178.16.54.22]:59045: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:13:56 dovecot_login authenticator failed for H=(ipjTnBPO) [185.230.124.69]:58394: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:14:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:14:15 dovecot_login authenticator failed for H=(7cpDXvP) [178.16.54.138]:57072: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:14:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:14:04 dovecot_login authenticator failed for H=(l9bqZDtf) [185.230.124.69]:57790: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:14:21 dovecot_login authenticator failed for H=(QKfbndx) [178.16.54.22]:52716: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:15:06 dovecot_login authenticator failed for H=(JAXrMeQiiR) [185.230.124.69]:63225: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:15:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:15:18 dovecot_login authenticator failed for H=(QTyW4cJc) [178.16.54.22]:56122: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:15:12 dovecot_login authenticator failed for H=(OjV6aKj398) [178.16.54.138]:50924: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:15:50 dovecot_login authenticator failed for H=(YicSR5IqX) [185.230.124.69]:63505: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:15:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.145
country_id: 2328926
description:
2026-01-31 05:15:14 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.145]:5108: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:16:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:16:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:16:07 dovecot_login authenticator failed for H=(v3fN2w) [185.230.124.69]:62779: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:16:01 dovecot_login authenticator failed for H=(VhL9BCoZMB) [178.16.54.22]:51276: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.211.30
country_id: 1814991
description:
2026-01-31 05:16:16 dovecot_login authenticator failed for H=([218.1.211.30]) [218.1.211.30]:55360: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-31 05:16:26 dovecot_login authenticator failed for H=([125.19.172.119]) [125.20.246.106]:36228: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:16:13 dovecot_login authenticator failed for H=(hwXqLK92) [178.16.54.138]:51700: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:17:11 dovecot_login authenticator failed for H=(s4e9HB) [178.16.54.138]:54247: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:17:13 dovecot_login authenticator failed for H=(YHYhw9) [185.230.124.69]:64295: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:17:48 dovecot_login authenticator failed for H=(hURAVRS) [185.230.124.69]:50167: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:17:02 dovecot_login authenticator failed for H=(G97lfVA5q) [178.16.54.22]:62245: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:17:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:17:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/component/tag/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:18:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:18:11 dovecot_login authenticator failed for H=(XTKhwMi) [178.16.54.138]:62771: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:18:19 dovecot_login authenticator failed for H=(FwEURrlXoY) [178.16.54.22]:56933: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:18:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:18:10 dovecot_login authenticator failed for H=(WU5A0x8L) [185.230.124.69]:64916: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-31 05:18:34 dovecot_login authenticator failed for H=(cm-84.210.151.158.get.no) [84.210.151.158]:37114: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-01-31 05:18:26 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:37346: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2026-01-31 05:19:57 dovecot_login authenticator failed for H=([87.200.93.86]) [87.200.93.86]:46983: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:19:03 dovecot_login authenticator failed for H=(u7Zvdlt) [185.230.124.69]:49871: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:19:18 dovecot_login authenticator failed for H=(DESU8H) [178.16.54.138]:50421: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.53.19
country_id: 1643084
description:
2026-01-31 05:19:47 dovecot_login authenticator failed for H=([103.138.53.19]) [103.138.53.19]:58513: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:19:58 dovecot_login authenticator failed for H=(HetYGPO3) [185.230.124.69]:56331: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.66
country_id: 6252001
description:
2026-01-31  5:19:58 16030 [Warning] Aborted connection 16030 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.66' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.132
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/photos/img/photos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:19:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:19:09 dovecot_login authenticator failed for H=(UAdVRixmwy) [178.16.54.22]:60017: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:20:17 dovecot_login authenticator failed for H=(QhZmY6lGDJ) [178.16.54.22]:51561: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:20:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.49.37.236
country_id: 6252001
description:
[2026-01-31 05:20:53 +0800] info [whostmgrd] 72.49.37.236 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-31 05:20:54 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:41831: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:20:21 dovecot_login authenticator failed for H=(FHcv8p65) [185.230.124.69]:61967: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.158.170.213
country_id: 2139685
description:
2026-01-31 05:20:46 dovecot_login authenticator failed for H=host-175-158-170-213.static.lagoon.nc [175.158.170.213]:47008: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:20:15 dovecot_login authenticator failed for H=(GzI7oE) [178.16.54.138]:50988: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:21:11 dovecot_login authenticator failed for H=(Pgt0rq) [185.230.124.69]:49321: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:21:11 dovecot_login authenticator failed for H=(n8nrtVzrk) [178.16.54.138]:57093: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:21:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:21:03 dovecot_login authenticator failed for H=(JilYvBryv) [178.16.54.22]:58228: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.69.22.152
country_id: 3469034
domain: vc-b.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20399.vc-b.com.my||ServerName:vc-b.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:130c2dca73a7977e88b75273b3c31f2d4a03c669||Title:0x408a3934||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:21:55 dovecot_login authenticator failed for H=(UZjSxjiT) [185.230.124.69]:55968: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:22:03 dovecot_login authenticator failed for H=(ChtrCt) [178.16.54.22]:55797: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:22:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:22:05 dovecot_login authenticator failed for H=(K5liwmcbO) [185.230.124.69]:49959: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:22:12 dovecot_login authenticator failed for H=(XMTVAg) [178.16.54.138]:63786: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:23:22 dovecot_login authenticator failed for H=(RZHl9G) [178.16.54.22]:53175: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:23:51 dovecot_login authenticator failed for H=(OtDRFnK) [185.230.124.69]:53965: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 05:23:10 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:19746: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:23:12 dovecot_login authenticator failed for H=(BFVIeCfv) [185.230.124.69]:63110: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:23:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:23:11 dovecot_login authenticator failed for H=(E0zCNXhU) [178.16.54.138]:56399: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2026-01-31 05:23:27 dovecot_login authenticator failed for H=([195.158.14.232]) [195.158.14.232]:55006: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.140.123.244
country_id: 1269750
domain: stealthvenom.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/cabecom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.121.214
country_id: 1269750
domain: vc-b.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27149.vc-b.com.my||ServerName:vc-b.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dba861e171b08afb602e841b5be18e2fe4036fdf||Title:0x7cb21e00||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/settingsimages/db.php||SC:/home/afsb/public_html/wp-content/uploads/settingsimages||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:24:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:24:21 dovecot_login authenticator failed for H=(J6KbJCOw) [178.16.54.22]:53773: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Track file upload for Infectors||RSV:7.71||T:APACHE||SC:/home/afsb/public_html/wp-content/themes/RightNow||User:afsb||WPU:||


plugin: modsec
rule: 77316797
name: IM360 WAF: RCE in uri used by KashmirBlack
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: RCE in uri used by KashmirBlack||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/RightNow/includes/uploadify/upload_settings_image.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: stealthvenom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.88.88.102
country_id: 2921044
domain: astlog.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/astlog.com.my/wp-json/wp/v2/posts HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-01-31 05:24:36 dovecot_login authenticator failed for H=(50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:37962: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:24:08 dovecot_login authenticator failed for H=(sZP5j3IB) [185.230.124.69]:57193: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.33.0
country_id: 6252001
description:
[2026-01-31 05:24:05 +0800] info [whostmgrd] 172.56.33.0 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.144.252.23
country_id: 6252001
description:
2026-01-31 05:24:29 dovecot_login authenticator failed for H=([108.144.252.23]) [108.144.252.23]:54087: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:24:01 dovecot_login authenticator failed for H=(RrxHKefsN) [178.16.54.138]:51613: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:25:52 dovecot_login authenticator failed for H=(eYs80Qj) [185.230.124.69]:53549: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:25:11 dovecot_login authenticator failed for H=(WJfWTLom1) [178.16.54.138]:61338: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Track file upload for Infectors||RSV:7.71||T:APACHE||SC:/home/afsb/public_html/wp-content/plugins/wp-time-capsule||User:afsb||WPU:||


plugin: modsec
rule: 77787844
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
name:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE\xe2\x80\x912020\xe2\x80\x9136849)

description:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE\xe2\x80\x912020\xe2\x80\x9136849)||MV:.php||FILES:TDN.php||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77787845
name: IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE-2020-36849)
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE-2020-36849)||MV:.php||FILES:TDN.php||FILES_NAMES:file||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: stealthvenom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/uploads/index.php||SC:/home2/cabecom/public_html/uploads||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 43.134.165.63
country_id: 1880251
domain: thinkcloud.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.192 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:25:01 dovecot_login authenticator failed for H=(aXxPXGo) [185.230.124.69]:50955: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: modsec
rule: 77787846
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
name:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE\xe2\x80\x912020\xe2\x80\x9136849)

description:
IM360 WAF: Arbitrary file upload in AIT CSV Import/Export <=3.0.3 (CVE\xe2\x80\x912020\xe2\x80\x9136849)||MV:.php||FILES:TDN.php||FILES_NAMES:file||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:25:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 124.108.50.12
country_id: 1831722
domain: af-sb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/TDN.php||SC:/home/afsb/public_html/wp-content/uploads/TDN.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:25:44 dovecot_login authenticator failed for H=(BXycqyG) [178.16.54.22]:62201: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:26:01 dovecot_login authenticator failed for H=(rtPuTR) [185.230.124.69]:54188: 535 Incorrect authentication data (set_id=finance)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/images/press.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:26:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:26:54 dovecot_login authenticator failed for H=(pjzOJk) [178.16.54.22]:65404: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:26:04 dovecot_login authenticator failed for H=(92AAaCN4V) [178.16.54.138]:64371: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-31 05:26:14 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:57423: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2026-01-31 05:26:25 dovecot_login authenticator failed for H=([27.24.141.88]) [27.24.141.88]:50972: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-31 05:26:52 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:45796: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: box.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/woh/public_html/wp-admin||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:27:33 dovecot_login authenticator failed for H=(yM116j0) [185.230.124.69]:58598: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:27:04 dovecot_login authenticator failed for H=(kbF8kje) [185.230.124.69]:53604: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.73.26
country_id: 1814991
description:
2026-01-31 05:27:11 dovecot_login authenticator failed for H=([14.20.73.26]) [14.20.73.26]:53680: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:27:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:27:13 dovecot_login authenticator failed for H=(sis8wVnpR) [178.16.54.138]:59647: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:27:23 dovecot_login authenticator failed for H=(X7CaW2WBG) [178.16.54.22]:59555: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:28:14 dovecot_login authenticator failed for H=(DdsQVb6) [185.230.124.69]:49588: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:28:22 dovecot_login authenticator failed for H=(wv86p9t6G) [178.16.54.22]:53100: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:28:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:28:16 dovecot_login authenticator failed for H=(qTKC3YhI) [178.16.54.138]:62237: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:29:16 dovecot_login authenticator failed for H=(PiD8W5e) [178.16.54.138]:57521: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:29:43 dovecot_login authenticator failed for H=(zqmmzJ0) [185.230.124.69]:60556: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:29:04 dovecot_login authenticator failed for H=(pKtGTmqV) [178.16.54.22]:65146: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:29:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:29:11 dovecot_login authenticator failed for H=(4h08zbI) [185.230.124.69]:63366: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:30:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account finance has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:30:02 dovecot_login authenticator failed for H=(5qguF2) [185.230.124.69]:63844: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:30:17 dovecot_login authenticator failed for H=(bheS6IL) [178.16.54.138]:58714: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:30:07 dovecot_login authenticator failed for H=(mXZ2NK) [178.16.54.22]:58329: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:30:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:31:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:31:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:31:37 dovecot_login authenticator failed for H=(90PFgJ) [178.16.54.22]:51002: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:31:09 dovecot_login authenticator failed for H=(TpqipU) [178.16.54.138]:56883: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-31 05:31:15 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:42044: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.145.123
country_id: 1814991
description:
2026-01-31 05:31:05 dovecot_login authenticator failed for H=([61.191.145.123]) [61.191.145.123]:38443: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:31:04 dovecot_login authenticator failed for H=(NaI5pM) [185.230.124.69]:54368: 535 Incorrect authentication data (set_id=ernest)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: inter-link.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/interlink/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:32:26 dovecot_login authenticator failed for H=(DzbMSN) [185.230.124.69]:64218: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:32:45 dovecot_login authenticator failed for H=(DMguI1L) [178.16.54.22]:50980: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:32:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:32:08 dovecot_login authenticator failed for H=(WPOB8oJ) [185.230.124.69]:63873: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.88.149
country_id: 6252001
description:
[2026-01-31 05:32:13 +0800] info [whostmgrd] 172.56.88.149 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:32:24 dovecot_login authenticator failed for H=(TpeAkaC) [178.16.54.138]:60903: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:32:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:33:06 dovecot_login authenticator failed for H=(gmkFM6) [178.16.54.138]:50456: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:33:10 dovecot_login authenticator failed for H=(CcdrTKdd) [185.230.124.69]:61137: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:33:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:33:51 dovecot_login authenticator failed for H=(aVH9l0) [178.16.54.22]:54603: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:33:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:34:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account limls@essemgroup.net has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:34:03 dovecot_login authenticator failed for H=(0kkJLnIaME) [185.230.124.69]:49432: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:34:04 dovecot_login authenticator failed for H=(Wz4ZzTZi2) [178.16.54.138]:53104: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:34:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:34:58 dovecot_login authenticator failed for H=(AthbVl) [178.16.54.22]:62884: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:35:00 dovecot_login authenticator failed for H=(zo4Jm9z9yP) [185.230.124.69]:62388: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:35:15 dovecot_login authenticator failed for H=(rLMaznIFd) [185.230.124.69]:63060: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:35:16 dovecot_login authenticator failed for H=(hrs0EiS0) [178.16.54.138]:50763: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:35:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:35:33 dovecot_login authenticator failed for H=(kPnvcnoNnp) [178.16.54.22]:58547: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2026-01-31 05:36:02 dovecot_login authenticator failed for H=([111.26.106.114]) [111.26.106.115]:51792: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:36:08 dovecot_login authenticator failed for H=(YtPs6oA) [185.230.124.69]:54948: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:36:50 dovecot_login authenticator failed for H=(Cj7erm) [178.16.54.138]:63527: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: mail.symphony-led.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/symphonyadmin/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-01-31 05:36:13 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:36228: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:36:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-31 05:36:55 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:42310: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:37:11 dovecot_login authenticator failed for H=(Nujfpm) [178.16.54.22]:52431: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:37:11 dovecot_login authenticator failed for H=(zsUX7q8jq) [185.230.124.69]:54055: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:37:55 dovecot_login authenticator failed for H=(E5ecqr) [185.230.124.69]:57141: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.21.229
country_id: 2017370
description:
2026-01-31 05:37:06 dovecot_login authenticator failed for H=([31.173.21.229]) [31.173.21.229]:38364: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:37:20 dovecot_login authenticator failed for H=(wDOiSN) [178.16.54.138]:51366: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.81.162.47
country_id: 6252001
description:
[2026-01-31 05:37:54 +0800] info [whostmgrd] 68.81.162.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:38:22 dovecot_login authenticator failed for H=(pxUPgs) [178.16.54.138]:63667: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 05:38:22 dovecot_login authenticator failed for H=(fkYmDs) [178.16.54.22]:60877: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.12
country_id: 1733045
description:
2026-01-31 05:38:40 dovecot_login authenticator failed for H=([49.124.153.12]) [49.124.153.12]:33504: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:38:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:38:11 dovecot_login authenticator failed for H=(GqDVdVp) [185.230.124.69]:62438: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-01-31 05:38:09 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:54998: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-31 05:39:12 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:47463: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:39:03 dovecot_login authenticator failed for H=(Nse7WJUiJw) [185.230.124.69]:59065: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:39:10 dovecot_login authenticator failed for H=(CDb3dY0B) [178.16.54.138]:56883: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.199
country_id: 1733045
description:
2026-01-31 05:39:19 dovecot_login authenticator failed for H=([49.124.149.199]) [49.124.149.199]:47742: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:39:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:40:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.143.163
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=11 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/mokshanacom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:40:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.54
country_id: 2802361
description:
2026-01-31 05:40:23 dovecot_login authenticator failed for H=(ADMIN) [181.214.218.54]:17738: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:40:18 dovecot_login authenticator failed for H=(pDjUqpnnwO) [185.230.124.69]:59723: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-01-31 05:40:14 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:49144: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:40:15 dovecot_login authenticator failed for H=(tuxr3VK) [178.16.54.138]:52463: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-31 05:40:30 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:54418: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:40:43 dovecot_login authenticator failed for H=(dkQgGOM) [185.230.124.69]:60913: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:41:18 dovecot_login authenticator failed for H=(j9UVRb) [178.16.54.138]:51986: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:41:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.53.172
country_id: 6252001
description:
[2026-01-31 05:41:17 +0800] info [whostmgrd] 46.110.53.172 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:41:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:41:08 dovecot_login authenticator failed for H=(IZUHCT) [185.230.124.69]:64840: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: dsc-expat.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/dscexpat/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.7.18.225
country_id: 3996063
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/teamwork.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:42:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:42:17 dovecot_login authenticator failed for H=(qD07m2xZ) [185.230.124.69]:58390: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:42:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:42:25 dovecot_login authenticator failed for H=(RfUs5maqZv) [178.16.54.138]:51117: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:43:32 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:43:34 dovecot_login authenticator failed for H=(4hnXXV) [178.16.54.138]:64978: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:43:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:43:06 dovecot_login authenticator failed for H=(sOd3jG) [185.230.124.69]:59543: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 05:43:08 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:32880: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 05:43:21 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:48332: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:43:30 dovecot_login authenticator failed for H=(1YIMs2slS) [185.230.124.69]:61648: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:44:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:44:59 dovecot_login authenticator failed for H=(8CNZxDmR) [178.16.54.138]:50790: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.114.129.100
country_id: 2017370
description:
2026-01-31 05:44:42 dovecot_login authenticator failed for H=(host-194-114-129-100.bisv.ru) [194.114.129.100]:60148: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-31 05:44:47 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:58078: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-31 05:44:54 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:45538: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 05:44:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account penny@indfinitydesign.com has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:44:20 dovecot_login authenticator failed for H=(c6s7hf80) [185.230.124.69]:55415: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:45:10 dovecot_login authenticator failed for H=(VhKF2lt) [185.230.124.69]:60815: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:45:30 dovecot_login authenticator failed for H=(wdX9z8bU) [178.16.54.138]:62636: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.86
country_id: 1269750
description:
2026-01-31 05:45:09 dovecot_login authenticator failed for H=([125.23.237.86]) [125.23.237.86]:57894: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.90.41.136
country_id: 1522867
description:
2026-01-31 05:45:20 dovecot_login authenticator failed for H=178.90.41.136.dynamic.telecom.kz [178.90.41.136]:38363: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:46:23 dovecot_login authenticator failed for H=(tPoa3qpX) [185.230.124.69]:53400: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:46:01 dovecot_login authenticator failed for H=(8jemzKHV2n) [185.230.124.69]:55177: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:46:01 dovecot_login authenticator failed for H=(ymxRf5) [178.16.54.138]:64043: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:47:03 dovecot_login authenticator failed for H=(ja5pRFoVbv) [178.16.54.138]:57131: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-31 05:47:54 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:59456: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.247.8.56
country_id: 6252001
description:
[2026-01-31 05:47:48 +0800] info [whostmgrd] 73.247.8.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:47:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
country_id: 1814991
description:
2026-01-31 05:47:29 dovecot_login authenticator failed for H=([39.152.120.40]) [39.152.120.40]:43274: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:47:07 dovecot_login authenticator failed for H=(6jcoJs91hp) [185.230.124.69]:62000: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:48:04 dovecot_login authenticator failed for H=(02ScHKGG0T) [185.230.124.69]:60540: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.141.121.93
country_id: 6252001
description:
[2026-01-31 05:48:12 +0800] info [whostmgrd] 73.141.121.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 05:48:24 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:28744: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: aircarbonic.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/aircarbonicadmin/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:48:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.242.155.155
country_id: 1269750
description:
2026-01-31 05:48:18 dovecot_login authenticator failed for H=([112.133.231.254]) [117.242.155.155]:47218: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:48:28 dovecot_login authenticator failed for H=(KxA4QR9E) [178.16.54.138]:57502: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-31 05:48:28 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:37306: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2026-01-31 05:48:31 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:49710: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:49:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb@vc-b.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:49:28 dovecot_login authenticator failed for H=(FF32oeCF4) [178.16.54.138]:53401: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:49:02 dovecot_login authenticator failed for H=(y4L74UL4) [185.230.124.69]:50653: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:49:13 dovecot_login authenticator failed for H=(WTIGJAHvqo) [185.230.124.69]:53383: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:50:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:50:02 dovecot_login authenticator failed for H=(mayr2Kw) [185.230.124.69]:54261: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.142
country_id: 1269750
description:
2026-01-31 05:51:13 dovecot_login authenticator failed for H=([152.52.238.92]) [182.95.184.142]:38752: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 05:51:24 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:50336: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.232.83.3
country_id: 3175395
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/cabecom/public_html/wp-admin||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.161.159.196
country_id: 2300660
domain: visoft.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91849.visoft.com.my||ServerName:visoft.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f24c9df250aea6da25571ef26499d14918df2d4||Title:0xdd4c24b9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-01-31 05:51:22 dovecot_login authenticator failed for H=([222.99.52.202]) [222.99.52.202]:49264: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 05:51:33 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:53789: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 05:51:06 dovecot_login authenticator failed for H=(HRErMOMOV) [178.16.54.138]:61049: 535 Incorrect authentication data (set_id=penny@indfinitydesign.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:51:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:51:08 dovecot_login authenticator failed for H=(gX46W0z9b1) [185.230.124.69]:62243: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:51:57 dovecot_login authenticator failed for H=(fetblVX) [185.230.124.69]:54137: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:52:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.169.174.59
country_id: 2921044
description:
2026-01-31 05:52:24 dovecot_login authenticator failed for H=patrickeinatz.com (h2769950.stratoserver.net) [81.169.174.59]:52316: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-01-31 05:52:57 dovecot_login authenticator failed for H=([125.21.245.33]) [182.64.3.134]:50820: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:52:03 dovecot_login authenticator failed for H=(mf7GzN3Erm) [185.230.124.69]:65319: 535 Incorrect authentication data (set_id=hanafi.vpb@vc-b.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.170.59
country_id: 3144096
description:
[2026-01-31 05:52:41 +0800] info [webmaild] 146.70.170.59 - eeyh@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:53:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.144.205.26
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/fzaninotto/faker/src/Faker/Calculator/Iban.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:53:09 dovecot_login authenticator failed for H=(9EWpWq581) [185.230.124.69]:64215: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-31 05:53:30 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:57648: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.239.154.72
country_id: 1814991
description:
2026-01-31 05:54:19 dovecot_login authenticator failed for H=([183.239.20.236]) [120.239.154.72]:57784: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.120.69.143
country_id: 3144096
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/webhost/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-01-31 05:54:35 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:21321: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:54:03 dovecot_login authenticator failed for H=(RPrUCdJd) [185.230.124.69]:50538: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.130
country_id: 1149361
description:
2026-01-31 05:54:49 dovecot_login authenticator failed for H=([149.54.62.130]) [149.54.62.130]:50551: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2026-01-31 05:54:47 dovecot_login authenticator failed for H=([59.94.39.65]) [59.94.39.65]:45946: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 79.221.174.229
country_id: 2921044
description:
Jan 31 05:54:55 sv3 pure-ftpd[3801914]: (?@79.221.174.229) [INFO] New connection from 79.221.174.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.80
country_id: 3625428
description:
2026-01-31 05:54:30 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.80]:38976: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.51.118.189
country_id: 3469034
description:
2026-01-31 05:54:40 dovecot_login authenticator failed for H=(189-51-118-65.rapeedo.net.br) [189.51.118.189]:40860: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:54:48 dovecot_login authenticator failed for H=(MW8G5s9Bg) [185.230.124.69]:64326: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 79.221.174.229
country_id: 2921044
description:
Jan 31 05:55:02 sv3 pure-ftpd[3801920]: (?@79.221.174.229) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.39.101.228
country_id: 6252001
description:
[2026-01-31 05:55:47 +0800] info [whostmgrd] 98.39.101.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:55:11 dovecot_login authenticator failed for H=(koaUedivc1) [185.230.124.69]:60685: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:56:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:56:01 dovecot_login authenticator failed for H=(pKVwoG11) [185.230.124.69]:55302: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.50.49
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=306191 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/pspolycom/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:57:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:57:05 dovecot_login authenticator failed for H=(QGB5gjy) [185.230.124.69]:63884: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:57:27 dovecot_login authenticator failed for H=(tGQkuvMOc) [185.230.124.69]:58395: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:58:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.16
country_id: 690791
description:
2026-01-31 05:58:16 dovecot_login authenticator failed for H=(ADMIN) [84.239.42.16]:11853: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/fkrcom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/autogrea/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:58:10 dovecot_login authenticator failed for H=(H8oGyi) [185.230.124.69]:53471: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: stillman.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/stillman/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:59:16 dovecot_login authenticator failed for H=(Bl3og5GD) [185.230.124.69]:61903: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: aoto.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/aotocom/public_html/images/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 05:59:58 dovecot_login authenticator failed for H=(mhcUXhDc) [185.230.124.69]:51065: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 05:59:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.179.201.167
country_id: 6252001
description:
[2026-01-31 06:00:07 +0800] info [whostmgrd] 184.179.201.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:00:18 dovecot_login authenticator failed for H=(7Kwkp4) [185.230.124.69]:50144: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.140.219.13
country_id: 2802361
description:
2026-01-31 06:00:32 dovecot_login authenticator failed for H=13.219.140.34.bc.googleusercontent.com (10.132.0.2) [34.140.219.13]:58158: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:00:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:00:21 dovecot_login authenticator failed for H=(1H8pyWv) [137.220.199.220]:52768: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:01:14 dovecot_login authenticator failed for H=(FowkTx8o2o) [137.220.199.220]:55056: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:01:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:01:18 dovecot_login authenticator failed for H=(mn6hQol0Z) [185.230.124.69]:52808: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:02:06 dovecot_login authenticator failed for H=(cDMEAxIkY2) [137.220.199.220]:58579: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:02:16 dovecot_login authenticator failed for H=(NyrsD5c) [185.230.124.69]:61052: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:02:17 dovecot_login authenticator failed for H=(1f6hPy6) [185.230.124.69]:56933: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.3
country_id: 1643084
description:
[2026-01-31 06:02:29 +0800] info [cpaneld] 95.135.92.3 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: eminent.st
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/eminent/public_html/wp-content/uploads/2024||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:03:15 dovecot_login authenticator failed for H=(UsJBZYuZU) [185.230.124.69]:59790: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:03:10 dovecot_login authenticator failed for H=(XJ6Km74Vs) [137.220.199.220]:62005: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2026-01-31 06:03:52 dovecot_login authenticator failed for H=(dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:38478: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:03:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:04:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:04:13 dovecot_login authenticator failed for H=(tTAcK6T1) [185.230.124.69]:50124: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:04:32 dovecot_login authenticator failed for H=(OGg7D4j4Z) [185.230.124.69]:54337: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2026-01-31 06:04:02 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:60686: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:04:04 dovecot_login authenticator failed for H=(FIaUhZar) [137.220.199.220]:65418: 535 Incorrect authentication data (set_id=jb-sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.206.225
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=509827 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 06:05:05 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:45301: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:05:10 dovecot_login authenticator failed for H=(dc5cLGSSc) [185.230.124.69]:56937: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.184.49
country_id: 6252001
description:
[2026-01-31 06:05:20 +0800] info [whostmgrd] 45.17.184.49 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 06:05:26 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:57117: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-31 06:05:56 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:38236: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:05:06 dovecot_login authenticator failed for H=(ZenGOZcoh) [137.220.199.220]:53125: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:05:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-31 06:05:47 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:38221: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:06:45 dovecot_login authenticator failed for H=(5oHny4) [185.230.124.69]:64063: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:06:07 dovecot_login authenticator failed for H=(u85OuvYw) [185.230.124.69]:59820: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:06:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:06:00 dovecot_login authenticator failed for H=(HyZRYXYKto) [137.220.199.220]:56775: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.204.215.220
country_id: 6252001
description:
[2026-01-31 06:06:44 +0800] info [whostmgrd] 97.204.215.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:07:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:07:04 dovecot_login authenticator failed for H=(Vb2hFSHzKj) [185.230.124.69]:61178: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:07:02 dovecot_login authenticator failed for H=(dg2IgGaVT) [137.220.199.220]:61720: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:08:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.31.218
country_id: 1835841
description:
2026-01-31 06:08:23 dovecot_login authenticator failed for H=([59.9.31.218]) [59.9.31.218]:45006: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:08:01 dovecot_login authenticator failed for H=(KZCL3mRiI) [185.230.124.69]:52931: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:08:14 dovecot_login authenticator failed for H=(RpYUXGtuSV) [137.220.199.220]:65238: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.111.247.114
country_id: 1269750
description:
2026-01-31 06:08:45 dovecot_login authenticator failed for H=([203.145.142.243]) [115.111.247.114]:59382: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:09:01 dovecot_login authenticator failed for H=(yveu2hrh) [185.230.124.69]:56884: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:09:01 dovecot_login authenticator failed for H=(KvqCIg) [185.230.124.69]:50037: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:09:07 dovecot_login authenticator failed for H=(9TRkxBnYn) [137.220.199.220]:52509: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:09:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hanafi.vpb has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-31 06:10:50 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:34846: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:10:18 dovecot_login authenticator failed for H=(y9tKrtidw) [185.230.124.69]:65221: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 06:10:39 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:47354: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:10:10 dovecot_login authenticator failed for H=(KeRgZS6) [137.220.199.220]:56428: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:11:04 dovecot_login authenticator failed for H=(Bo6YyT) [137.220.199.220]:60194: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:11:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:11:15 dovecot_login authenticator failed for H=(BiBie2vwh) [185.230.124.69]:50878: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:11:15 dovecot_login authenticator failed for H=(VcHcZhS) [185.230.124.69]:64653: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 06:12:05 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:54378: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:12:03 dovecot_login authenticator failed for H=(FGNqBYDXmG) [137.220.199.220]:65242: 535 Incorrect authentication data (set_id=jb-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:12:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/products.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:12:12 dovecot_login authenticator failed for H=(HBTznEh) [185.230.124.69]:50647: 535 Incorrect authentication data (set_id=hanafi.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-31 06:12:18 dovecot_login authenticator failed for H=([182.95.184.82]) [182.95.184.82]:59154: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-31 06:12:37 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:54846: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/hairfex/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-31 06:12:50 dovecot_login authenticator failed for H=([27.123.92.202]) [27.123.92.202]:59314: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:13:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.64.42
country_id: 1668284
description:
2026-01-31 06:13:11 dovecot_login authenticator failed for H=124-11-64-42.static.tfn.net.tw [124.11.64.42]:58267: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31  6:13:23 17989 [Warning] Aborted connection 17989 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:13:10 dovecot_login authenticator failed for H=(BOOPEQb) [185.230.124.69]:64635: 535 Incorrect authentication data (set_id=ernest)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/hairfex/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:13:18 dovecot_login authenticator failed for H=(xGzXcpZCHQ) [137.220.199.220]:52947: 535 Incorrect authentication data (set_id=jb-sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: fimco.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/fimco/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-01-31 06:13:20 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net [111.70.32.50]:56168: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:13:48 dovecot_login authenticator failed for H=(z8nywl) [185.230.124.69]:57784: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-31 06:14:12 dovecot_login authenticator failed for H=(cN256sgmBV) [137.220.199.220]:56389: 535 Incorrect authentication data (set_id=jb-sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 155.93.138.130
country_id: 953987
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2445 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:14:07 dovecot_login authenticator failed for H=(bRj1GnG) [185.230.124.69]:53736: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:14:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:15:04 dovecot_login authenticator failed for H=(73atgdQlQ) [185.230.124.69]:60387: 535 Incorrect authentication data (set_id=ernest)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.90.101.216
country_id: 2328926
domain: www.euratech.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:102.90.101.216||TA:102.90.101.216||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 06:15:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2026-01-31 06:15:57 dovecot_plain authenticator failed for H=c-68-83-181-181.hsd1.pa.comcast.net (enturval) [68.83.181.181]:58912: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-31 06:15:52 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (gnizates) [68.82.141.145]:48742: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:16:01 dovecot_login authenticator failed for H=(DzhB6hXPhI) [185.230.124.69]:56915: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:17:17 dovecot_login authenticator failed for H=(1Y3L6H) [185.230.124.69]:63943: 535 Incorrect authentication data (set_id=ernest)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.99.104.98
country_id: 2589581
domain: vtgroupsb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:99878.vtgroupsb.com||ServerName:vtgroupsb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8a3bec1ae3df7ade3343942bf5942723c300421||Title:0x6fc8b764||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-31 06:17:38 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:50013: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.146.126
country_id: 1814991
description:
2026-01-31 06:17:05 dovecot_login authenticator failed for H=([27.45.146.126]) [27.45.146.126]:52455: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.255.195
country_id: 1269750
description:
2026-01-31 06:17:31 dovecot_login authenticator failed for H=([103.176.255.195]) [103.176.255.195]:57149: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.235.154.114
country_id: 1814991
description:
2026-01-31 06:17:50 dovecot_login authenticator failed for H=([221.235.154.114]) [221.235.154.114]:34406: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1ce62a81fb62de4dd42cb3e2eeb8009463961151||Title:0x5aa42756||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:18:33 dovecot_login authenticator failed for H=(GhIk3iX) [185.230.124.69]:56627: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 06:18:14 dovecot_login authenticator failed for H=(WP9rtU1) [185.230.124.69]:62444: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.21
country_id: 6252001
description:
2026-01-31 06:18:21 dovecot_login authenticator failed for H=(ADMIN) [151.241.122.21]:42071: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.7.124
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&sub=8 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.7.110.23
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88361515570398 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.51.74
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=547334 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/woh/wcc.com.my/assets||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6936bdfc18b94d74b64544e811408257fcb4988b||Title:0xcf237037||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd05f657ca7890b081ffed6f998c3962d3092bb0||Title:0x3e655f2a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.152.58.188
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=594602 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.100.196.146
country_id: 3144096
domain: myfurnitureshop.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/myfurnit/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2026-01-31 06:23:42 dovecot_login authenticator failed for H=(nsg-corporate-126.60.187.122.airtel.in) [122.187.60.126]:37468: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 06:23:42 H=([45.144.212.50]) [45.144.212.50]:65278 F=<zuleyha@savalanshipping.com> rejected RCPT <astkua@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 06:23:05 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:46297: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.100.196.146
country_id: 3144096
domain: myfurnitureshop.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/myfurnit/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.131.53.226
country_id: 614540
description:
2026-01-31 06:23:13 dovecot_login authenticator failed for H=([213.131.53.226]) [213.131.53.226]:42783: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:84eb743f02d7106f1420217abce7bdf391cd5810||Title:0x05f75eac||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jan 31 06:24:57 sv3 pure-ftpd[3820160]: (?@47.84.199.24) [WARNING] Authentication failed for user [woodlinetrd@gmail.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.223.146
country_id: 1562822
description:
2026-01-31 06:24:06 dovecot_login authenticator failed for H=([125.212.223.146]) [125.212.223.146]:2137: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.241.118
country_id: 2661886
description:
2026-01-31 06:24:20 dovecot_login authenticator failed for H=([188.126.241.118]) [188.126.241.118]:35340: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2026-01-31 06:24:22 dovecot_login authenticator failed for H=([220.122.115.9]) [220.122.115.9]:39598: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-31 06:24:36 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:50394: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.228.211
country_id: 1814991
description:
2026-01-31 06:25:21 dovecot_login authenticator failed for H=([59.110.5.198]) [36.132.228.211]:10453: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.169
country_id: 1814991
description:
2026-01-31 06:25:47 dovecot_login authenticator failed for H=([111.57.17.169]) [111.57.17.169]:38864: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:10ab1e548aeaa9b3f44ef4e2c8bd8de24baf7618||Title:0x49bbae4e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-31 06:25:47 dovecot_login authenticator failed for H=([182.95.215.73]) [182.95.230.134]:46098: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/pftfood/public_html/images||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f79dfa450f1ae951a8ca02b2e07a18f0229c7660||Title:0x487daccc||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 187.246.24.216
country_id: 3996063
domain: www.usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/news-and-events.php||SC:/home2/usfoodcom/public_html/img/news-and-events.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1042fe57df2950fbf8f11364b0c8fb225ae426fa||Title:0x803db331||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-01-31 06:28:12 dovecot_login authenticator failed for H=([125.138.166.217]) [125.138.166.217]:60690: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-31 06:28:25 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:47860: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2026-01-31 06:29:56 dovecot_login authenticator failed for H=(static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:56546: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-31 06:29:47 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:50742: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.203.163.199
country_id: 1694008
domain: wcc.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83858.wcc.com.my||ServerName:wcc.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:09da7535a510eaefec029ee2e5f98c4eead4426a||Title:0xa86269ff||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e56244670f8f5d3133123c720e93a05e91fed1b||Title:0xf48e7ef9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-01-31 06:31:06 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.98.104.138]:53612: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-31 06:31:16 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:51918: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 06:32:17 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:42726: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.76.210.200
country_id: 2802361
description:
2026-01-31  6:32:16 18757 [Warning] Aborted connection 18757 to db: 'unconnected' user: 'unauthenticated' host: '34.76.210.200' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd1acf2e122f1c8f76f80f0859e7c93c447ed233||Title:0x659e2c81||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.210.43
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=286855 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-31 06:34:09 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:53447: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-31 06:34:18 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:35154: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8b88870335c08ed143df899ae97a3719ddac4a72||Title:0xeac4c1f2||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 24.77.77.1
country_id: 6251999
domain: webhosting2u.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98397.webhosting2u.com||ServerName:webhosting2u.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d70ccd769f592617dead36c25496336d3b4b7f3||Title:0xd63d7ab0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.22.151.18
country_id: 2802361
description:
2026-01-31  6:35:46 18904 [Warning] Aborted connection 18904 to db: 'unconnected' user: 'unauthenticated' host: '34.22.151.18' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.249.32.92
country_id: 1814991
description:
2026-01-31 06:35:14 dovecot_login authenticator failed for H=([183.71.251.66]) [113.249.32.92]:40389: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: modern.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/modern/public_html/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2026-01-31 06:35:26 dovecot_login authenticator failed for H=([128.185.194.22]) [128.185.194.22]:51252: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bfebc87d6bced8f2ca3c89dc17cbc25f26fc8fff||Title:0x2fb24945||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:703e5006461f7ab048aa5afbd683583b30795ae6||Title:0x7856d6e3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.22.151.143
country_id: 2802361
description:
2026-01-31  6:37:00 18959 [Warning] Aborted connection 18959 to db: 'unconnected' user: 'unauthenticated' host: '34.22.151.143' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: cordage.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/admincordage/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.197.201
country_id: 6252001
description:
2026-01-31 06:39:18 dovecot_login authenticator failed for H=(ADMIN) [37.19.197.201]:4977: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:470ab4f462fcda00c5adc054b9517615122ac601||Title:0x2983548f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 06:40:04 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:53779: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
country_id: 1814991
description:
2026-01-31 06:40:13 dovecot_login authenticator failed for H=([117.32.102.90]) [117.32.102.90]:52720: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-01-31 06:41:18 dovecot_login authenticator failed for H=([119.192.59.80]) [119.192.59.80]:58642: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.195.135.222
country_id: 1814991
description:
2026-01-31 06:41:26 dovecot_login authenticator failed for H=([183.195.135.222]) [183.195.135.222]:53774: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 06:41:27 H=(localhost.localdomain) [78.153.140.207]:41494 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.58.204
country_id: 1835841
description:
2026-01-31 06:41:44 dovecot_login authenticator failed for H=([211.216.58.204]) [211.216.58.204]:52329: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.3
country_id: 6252001
domain: pspoly.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f9d3c540663c28c5cbf97e76f2f28df5f9eea189||Title:0xe2248d04||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2026-01-31 06:42:12 dovecot_login authenticator failed for H=([207.219.221.101]) [207.219.221.101]:38732: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-31 06:42:24 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:60046: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2026-01-31 06:42:39 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:47620: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.152.22
country_id: 1835841
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/krisfood/public_html/wp-includes||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a83a7aac40fb9db84572e6ef2e3d4eefd0124930||Title:0x40de4bad||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2026-01-31 06:42:04 dovecot_login authenticator failed for H=249.151.48.116.static.netvigator.com [116.48.151.249]:53585: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-31 06:42:31 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:39715: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.26.99.150
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38421515745101 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-31 06:44:27 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:49346: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 06:44:46 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:51344: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6a87a78cec1c7c71be1d85e7ee8e2f793d8eb778||Title:0x0805558b||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: cloud.imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/tuju7822/erp.tujusetia.my.tujusetia.my/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.63.253.214
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=69&page=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a580951508578848b140eeed4b0903cfe54fd9a||Title:0xd51ef8c4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.242
country_id: 2017370
description:
2026-01-31 06:47:25 dovecot_login authenticator failed for H=([31.173.9.242]) [31.173.9.242]:48411: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:465fb57c4f2df788baaf4530867d04be07033b4b||Title:0x7fbefb40||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-31 06:47:44 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:49208: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
country_id: 1814991
description:
2026-01-31 06:47:36 dovecot_login authenticator failed for H=([220.180.107.193]) [220.180.107.193]:49300: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-01-31 06:48:17 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:56450: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-01-31 06:48:23 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:37206: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-31 06:48:44 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:50712: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce38485fe7fb63f8d4e452aa6d4fe1392b4c0983||Title:0x1655fec6||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.129.89
country_id: 1861060
domain: tschuan.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/tschuan/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-01-31 06:49:41 dovecot_login authenticator failed for H=([31.173.8.170]) [31.173.8.170]:32920: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.40.121.4
country_id: 1643084
description:
2026-01-31 06:49:03 dovecot_login authenticator failed for H=([103.40.121.4]) [103.40.121.4]:57218: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.195.255.12
country_id: 1835841
description:
2026-01-31 06:49:27 dovecot_login authenticator failed for H=([124.195.255.12]) [124.195.255.12]:53924: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.152.22
country_id: 1835841
domain: mail.oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/oxboldc/public_html/wp-includes||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bce96079a7453273c50cede3424a1d48d539a741||Title:0x9ba5ac31||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6191530ffe8908b02ad6154f49a071e784d2e940||Title:0xac2ac4c7||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.65.202.110
country_id: 2921044
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/wpr-addons/forms/wp.php||SC:/home/pftfood/public_html/wp-content/uploads/wpr-addons||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-31 06:52:21 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:33822: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-31 06:52:32 dovecot_login authenticator failed for H=(177-174-16-81.user.vivozap.com.br) [177.174.16.55]:44068: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/mschemic/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2026-01-31 06:53:02 dovecot_login authenticator failed for H=([103.219.154.156]) [103.219.154.156]:46248: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home2/mschemic/public_html/wp-content/uploads/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-01-31 06:53:12 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net [111.70.28.243]:40917: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97884b87b848ff92aa5fc6cf23668808a0e512eb||Title:0x2aa28a68||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57f2f62c0aa3050e60f0bc8a8fe9ecee17740552||Title:0xa1e75c51||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-31 06:55:00 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (spron) [73.213.237.28]:42596: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.71.207.245
country_id: 1880251
description:
[2026-01-31 06:54:04 +0800] info [cpaneld] 167.71.207.245 - 2083mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.165.224.154
country_id: 953987
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/index-3.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31  6:55:52 19558 [Warning] Aborted connection 19558 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e59900f7f37fb5d48b6959ca787e2523f5a7723c||Title:0x66642deb||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.59.252.23
country_id: 6252001
description:
[2026-01-31 06:57:08 +0800] info [webmaild] 108.59.252.23 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: figofoods.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo TEST_1769813858',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.43.42
country_id: 2017370
description:
2026-01-31 06:58:10 dovecot_login authenticator failed for H=([188.247.43.42]) [188.247.43.42]:38822: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-31 06:58:49 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:59077: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.172
country_id: 99237
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/product-knowledge.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90732475ca46ff41f871f84c9457f94512ea5638||Title:0x1aed0f0d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.49
country_id: 3057568
description:
2026-01-31 06:58:19 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.49]:21242: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-31 06:58:21 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:59986: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-31 06:59:04 dovecot_login authenticator failed for H=([182.95.230.142]) [182.95.230.142]:48982: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ae1396cf994e360ed06ba0702e61ead892f25aaa||Title:0xa2f41d73||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-01-31 06:59:36 dovecot_login authenticator failed for H=([125.61.36.22]) [125.61.36.22]:43289: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.115.88
country_id: 1814991
description:
2026-01-31 06:59:18 dovecot_login authenticator failed for H=([183.6.115.88]) [183.6.115.88]:43818: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.129.210
country_id: 1861060
domain: mail.stonewld.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/stonewld/public_html/mail/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 07:00:26 dovecot_login authenticator failed for H=(0O92R6hUO) [158.94.208.110]:57134: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58a34822f561d871023e112010d24eb98c3dabd6||Title:0x0de194ad||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home/pftfood/public_html/wp-admin/images/autoload_classmap.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31  7:01:31 19841 [Warning] Aborted connection 19841 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/media/autoload_classmap.php||SC:/home/pftfood/public_html/wp-includes/images/media/autoload_classmap.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/egbwawasancom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 07:01:14 dovecot_login authenticator failed for H=(G1qVuB) [158.94.208.110]:65166: 535 Incorrect authentication data (set_id=bktan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin88.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:287a98d852ebabdf7998336a1b811c23b11da54a||Title:0x69a4a79b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 07:02:48 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:47042: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/about.php||SC:/home/pftfood/public_html/wp-includes/images/about.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/pftfood/public_html/wp-includes/sodium_compat/src/index.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-31 07:03:11 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:51792: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31  7:03:51 20038 [Warning] Aborted connection 20038 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:de57f19807e60047f07c3fe95ee1967544ae372f||Title:0x2bb16107||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/pftfood/public_html/wp-includes/SimplePie/Content||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2023/08/autoload_classmap.php||SC:/home/pftfood/public_html/wp-content/uploads/2023||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.166.131
country_id: 3865483
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/product-sub.php?id=23&sub=6 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-01-31 07:04:59 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.175.182]:56422: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:113325e2efb728deb77b49ffa51eb58023d365be||Title:0x377c8c1b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-31 07:04:39 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:33712: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-31  7:04:36 20057 [Warning] Aborted connection 20057 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-31 07:04:49 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:46830: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2026-01-31 07:05:40 dovecot_login authenticator failed for H=([114.30.180.58]) [114.30.180.58]:52024: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-31 07:05:50 dovecot_login authenticator failed for H=([182.95.176.122]) [182.95.176.122]:59946: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-31 07:05:22 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:34657: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2026-01-31 07:05:36 dovecot_login authenticator failed for H=([111.38.136.211]) [111.38.136.211]:42614: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1f73b8082c16778faa8c89fc7909ee997476ff85||Title:0xb8e9be2a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.249.143
country_id: 3469034
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/shop.php?id=1&sub=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-01-31 07:06:33 dovecot_login authenticator failed for H=([125.21.245.33]) [182.64.3.134]:48674: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2da1b9f139687f9228af553550f204ff941316f||Title:0x475e5290||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-31 07:06:45 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:44360: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 07:06:58 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:58454: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:836609855aeccf3aeb23ee825f81afbcde47a455||Title:0x2c2752d3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2026-01-31 07:07:33 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:60008: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:08:00 dovecot_login authenticator failed for H=(VUpV0PE) [69.5.189.21]:57541: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.183
country_id: 2750405
description:
2026-01-31  7:07:08 20130 [Warning] Aborted connection 20130 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.183' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.36.19.41
country_id: 2510769
description:
2026-01-31 07:07:14 dovecot_login authenticator failed for H=(62.36.19.41.static.abi.uni2.es) [62.36.19.41]:50691: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.184.13
country_id: 1814991
description:
2026-01-31 07:07:50 dovecot_login authenticator failed for H=([27.188.184.13]) [27.188.184.13]:41256: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-31 07:08:19 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:33192: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:08:24 dovecot_login authenticator failed for H=(WW3qv2wRI) [69.5.189.21]:61724: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 07:08:30 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:47308: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4776f969f66d2af2ba2e0f4369d11c851e053b0e||Title:0x92f95903||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.148
country_id: 2635167
description:
2026-01-31  7:09:55 20200 [Warning] Aborted connection 20200 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.148' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-31 07:09:28 dovecot_login authenticator failed for H=([36.135.62.102]) [36.135.62.103]:55470: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2026-01-31 07:09:44 dovecot_login authenticator failed for H=([110.172.147.190]) [110.172.147.190]:44608: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:09:12 dovecot_login authenticator failed for H=(TVHrGx7Ij) [69.5.189.21]:53468: 535 Incorrect authentication data (set_id=louiswong)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28d7c5fd97fd3e0e40ab1d87086abc26f9a16d96||Title:0xd8ec9909||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2026-01-31 07:09:16 dovecot_login authenticator failed for H=(dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:44026: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.95.73.31
country_id: 1814991
description:
2026-01-31 07:09:53 dovecot_login authenticator failed for H=(31.73.95.218.broad.yc.jx.dynamic.163data.com.cn) [218.95.73.31]:47632: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23e814ebfc409a13edbb408cd49ec5b57b27bafc||Title:0x31e93b77||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:10:21 dovecot_login authenticator failed for H=(6fe2ydk) [69.5.189.21]:51874: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:11:09 dovecot_login authenticator failed for H=(IdW6vBPwYG) [69.5.189.21]:59521: 535 Incorrect authentication data (set_id=louiswong)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:500a3779012738735a6be5b4517133dd81faee5f||Title:0xb55d5a47||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 07:11:52 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:36379: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.235.78
country_id: 3625428
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/slide-page/construction-work HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:11:24 dovecot_login authenticator failed for H=(0yUn2XXa) [178.16.54.138]:56759: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 07:12:10 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:54167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:12:39 dovecot_login authenticator failed for H=(6DvNBF6) [178.16.54.138]:50230: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cbfe4264ba15851c7b5826d8d70e5493f8eb6804||Title:0x7e4a171f||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/imaxcom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:12:18 dovecot_login authenticator failed for H=(vZFyNi3) [69.5.189.21]:54204: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 07:12:01 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:54010: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31  7:13:03 20294 [Warning] Aborted connection 20294 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4cdc0199801b436df34d77bfa139f3ec8dee8e5a||Title:0x997a6eb0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-31 07:13:23 dovecot_login authenticator failed for H=(nsg-corporate-80.229.187.122.airtel.in) [122.187.229.80]:45174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 07:13:06 dovecot_login authenticator failed for H=(0Wc5o1) [69.5.189.21]:61855: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 07:13:11 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:53138: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:13:19 dovecot_login authenticator failed for H=(gu9fWsRS5e) [178.16.54.138]:50387: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-31 07:13:55 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:11904: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-31 07:14:03 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:12347: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:14:21 dovecot_login authenticator failed for H=(xSovu9) [178.16.54.138]:55408: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7403494bcf5f682eb3f7c45da582393884c0f745||Title:0x2a49efdc||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.232.44.198
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62511515979613 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 07:15:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:57905: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-31 07:15:39 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:50370: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2026-01-31 07:15:07 dovecot_login authenticator failed for H=165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:58003: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 07:15:42 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:34536: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f0d9ab85992db59f78973003e4d0493c164dc78d||Title:0xe258ed17||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 07:15:23 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:36112: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:15:26 dovecot_login authenticator failed for H=(Si84uZZua) [178.16.54.138]:63208: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 07:15:27 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.30.233
country_id: 1269750
description:
2026-01-31 07:16:32 dovecot_login authenticator failed for H=([59.90.30.233]) [59.90.30.233]:54738: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-01-31 07:16:23 dovecot_login authenticator failed for H=([152.52.234.33]) [182.95.174.18]:41310: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:16:32 dovecot_login authenticator failed for H=(Zj6OHTa) [178.16.54.138]:62486: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:phua8686.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6565f3b7419d757e39a64c39dda7c7871c7b003b||Title:0x55040dee||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:17:05 dovecot_login authenticator failed for H=(IYFPkldJ) [178.16.54.138]:64819: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:51766250676cc0069ffa467ff22a55124dd29c0a||Title:0xb692d9c5||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2026-01-31 07:17:52 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [95.158.39.201]:41577: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-01-31 07:17:56 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:61636: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.190.238.64
country_id: 1814991
description:
2026-01-31 07:18:10 dovecot_login authenticator failed for H=([115.190.238.64]) [115.190.238.64]:41160: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.248.238.187
country_id: 1835841
description:
2026-01-31 07:18:11 dovecot_login authenticator failed for H=([106.248.238.187]) [106.248.238.187]:47327: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 07:18:55 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:57426: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.129.210
country_id: 1861060
domain: mail.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/sutsbcom/public_html/wp-includes/images/wp-login.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.107
country_id: 1880251
description:
2026-01-31 07:19:00 dovecot_login authenticator failed for H=(ADMIN) [156.146.57.107]:17512: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:18:09 dovecot_login authenticator failed for H=(BkSpnVK) [178.16.54.138]:55135: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d573e08ed773a3fd5b03fa1b51db6db62875a1d||Title:0xb181d30c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:18:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:febbb4b8dfdf938e28972949a1a8b4104b92cdbb||Title:0xdc67d57a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-31 07:19:51 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:50349: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:19:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-01-31 07:19:05 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:46562: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.249.20.14
country_id: 1814991
description:
2026-01-31 07:19:14 dovecot_login authenticator failed for H=([140.249.20.14]) [140.249.20.14]:41835: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:19:20 dovecot_login authenticator failed for H=(WVHuzD) [178.16.54.138]:61536: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.211.233.218
country_id: 1814991
description:
2026-01-31 07:19:31 dovecot_login authenticator failed for H=([60.211.233.218]) [60.211.233.218]:5198: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:20:08 dovecot_login authenticator failed for H=(VxJBfe5p) [178.16.54.138]:56575: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0927ef05095540c0d002e9dc3f9987a339084c65||Title:0x06b5d22a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2026-01-31 07:20:15 dovecot_login authenticator failed for H=([110.185.173.167]) [110.185.173.167]:44004: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-31 07:20:22 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:32964: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:20:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2026-01-31 07:20:13 dovecot_login authenticator failed for H=([128.185.101.201]) [122.185.146.18]:43934: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2026-01-31 07:20:24 dovecot_login authenticator failed for H=([202.90.133.142]) [202.90.133.142]:16914: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:21:11 dovecot_login authenticator failed for H=(1Do8Vs9) [178.16.54.138]:56714: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6eee4654a0907a6b5c97105508cf358a39a14ea||Title:0x7938bc02||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:21:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: stonewld.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/stonewld/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:22:09 dovecot_login authenticator failed for H=(nsdEGcbL) [178.16.54.138]:64989: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:22:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jc@mckd.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:22:23 dovecot_login authenticator failed for H=(G1TSJR) [178.16.54.138]:61696: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bbfb0010015aabd527b4247be20719bbc00dd986||Title:0x88cddc45||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-31 07:22:24 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:55656: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.88.184
country_id: 1668284
description:
2026-01-31 07:23:35 dovecot_login authenticator failed for H=110-25-88-184.adsl.fetnet.net [110.25.88.184]:47669: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 07:23:21 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:59782: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8ccd729e8019ddca5de6ca80feac903068c1bd4||Title:0x90edb494||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-31 07:23:16 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:53874: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-31 07:23:21 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:33218: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:23:23 dovecot_login authenticator failed for H=(HstaPlyq70) [178.16.54.138]:56777: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-01-31 07:24:41 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:49220: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:24:18 dovecot_login authenticator failed for H=(4uKAE3) [178.16.54.138]:64857: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e20e73b698e82fe3c2cdf5c81d7da6e1c4735743||Title:0xa9d036bc||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.64.116
country_id: 1282988
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/productt.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-01-31 07:24:50 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:54416: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
country_id: 1814991
description:
2026-01-31 07:24:41 dovecot_login authenticator failed for H=([60.18.139.82]) [60.18.139.82]:47804: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:25:08 dovecot_login authenticator failed for H=(7AWSGR) [178.16.54.138]:63715: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.111
country_id: 1814991
description:
2026-01-31 07:25:38 dovecot_login authenticator failed for H=([27.24.141.111]) [27.24.141.111]:59146: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-31 07:25:51 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:54439: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42a9e78badc84f176d92b52d52247b0c1cc35959||Title:0xb2cc74b4||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.131.71.34
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/https:/www.the3rdeye.com.my/home/therdeye/public_html/www.feliogroup.com||User:feliogroupcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-31 07:25:54 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:42574: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 07:25:40 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:36128: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:26:06 dovecot_login authenticator failed for H=(JL6YCDRq) [158.94.209.22]:53750: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c008d7047739733724da4bf2b3e405063f69d408||Title:0x4e86a17b||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 68.221.64.41
country_id: 2510769
domain: kdiballoon.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/kdiballo1/public_html/wp-admin||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-31 07:26:30 H=([62.60.130.227]) [62.60.130.227]:53381 F=<mcinfo@ups.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from ups.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:26:07 dovecot_login authenticator failed for H=(xwNsEpQz) [178.16.54.138]:62487: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: ahfengineering.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/ahfe3522/public_html/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 07:27:22 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:60060: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.113.174.219
country_id: 2017370
description:
2026-01-31 07:27:40 dovecot_plain authenticator failed for H=(uhtnslg5u8a4pncl91) [188.113.174.219]:52897: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 07:27:50 H=(localhost.localdomain) [78.153.140.207]:42446 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ae8396a288c02bf58e4af2b9451cff680e434720||Title:0x8a7f48e3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:27:17 dovecot_login authenticator failed for H=(7SW0JFI) [158.94.209.22]:52652: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:27:30 dovecot_login authenticator failed for H=(QzAvf4) [178.16.54.138]:59338: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2026-01-31 07:27:32 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:49888: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:27:13 dovecot_login authenticator failed for H=(dglP7nqa) [178.16.54.138]:56832: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:28:14 dovecot_login authenticator failed for H=(BpX1lS) [178.16.54.138]:61957: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2026-01-31 07:28:19 dovecot_login authenticator failed for H=([111.26.79.112]) [111.26.79.112]:50794: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:28:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90db5ca257e599beffc19700ceb31e3f1c06b454||Title:0x47635476||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2026-01-31 07:28:08 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:45966: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.199.37
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event-single.php?id=702312 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:28:11 dovecot_login authenticator failed for H=(xmj0l27aW) [158.94.209.22]:57619: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:29:05 dovecot_login authenticator failed for H=(GogC1go) [158.94.209.22]:49213: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.57
country_id: 6252001
description:
2026-01-31  7:29:33 20867 [Warning] Aborted connection 20867 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.57' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:29:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.3.113
country_id: 2750405
description:
2026-01-31  7:29:21 20856 [Warning] Aborted connection 20856 to db: 'unconnected' user: 'unauthenticated' host: '185.242.3.113' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 07:29:38 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:40712: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:29:24 dovecot_login authenticator failed for H=(KXyr86r8e) [158.94.209.22]:60886: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.36.175.218
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:tuju-guest.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00b6b26fb13111a88278d09119a2c637e68f73de||Title:0x811c51a7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:29:09 dovecot_login authenticator failed for H=(SHNLJXPI2) [178.16.54.138]:63818: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:30:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:30:29 dovecot_login authenticator failed for H=(IWyrAzKNZ) [178.16.54.138]:59623: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-31 07:30:20 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:38522: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-31 07:30:24 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:56543: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:30:17 dovecot_login authenticator failed for H=(scevsG2j) [158.94.209.22]:64981: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 07:31:52 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:44290: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 07:31:07 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:36918: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:31:11 dovecot_login authenticator failed for H=(d4zX5c) [158.94.209.22]:55134: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:31:30 dovecot_login authenticator failed for H=(FvRfBFjvGM) [158.94.209.22]:51382: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:31:03 dovecot_login authenticator failed for H=(xtJUsIX) [178.16.54.138]:55200: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:31:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:32:05 dovecot_login authenticator failed for H=(rWORoFZ) [158.94.209.22]:57089: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:32:32 dovecot_login authenticator failed for H=(iVk5SMc3bh) [178.16.54.138]:62484: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.70.186.174
country_id: 2077456
domain: dsc-expat.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/dscexpat/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 07:32:51 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:28489: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:33:36 dovecot_login authenticator failed for H=(9vsCILjtqW) [158.94.209.22]:53832: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:33:03 dovecot_login authenticator failed for H=(Kx2yPm) [178.16.54.138]:53221: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:33:17 dovecot_login authenticator failed for H=(gt1vIKdgxn) [158.94.209.22]:54804: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 07:33:56 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:20972: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:33:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 07:33:01 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49868: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:34:11 dovecot_login authenticator failed for H=(VtrtpeX) [158.94.209.22]:53468: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 07:34:09 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:44060: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 07:34:35 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:41531: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 07:34:51 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:40383: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:34:22 dovecot_login authenticator failed for H=(Ri1QvIh) [178.16.54.138]:64613: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 07:35:52 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:54023: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:35:09 dovecot_login authenticator failed for H=(3hVTVXsfb) [178.16.54.138]:62534: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-31 07:35:09 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:46792: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 07:35:20 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:37690: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:35:42 dovecot_login authenticator failed for H=(oYj0klUKQA) [158.94.209.22]:52298: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:35:05 dovecot_login authenticator failed for H=(JkpGl4Q) [158.94.209.22]:52597: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:36:17 dovecot_login authenticator failed for H=(P8UDeWZ) [158.94.209.22]:63024: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:36:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-01-31 07:36:29 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:54810: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: box.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/woh/box.com.my/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:36:14 dovecot_login authenticator failed for H=(qXWmW9E3) [178.16.54.138]:50408: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2026-01-31 07:36:37 dovecot_login authenticator failed for H=(nsg-corporate-80.229.187.122.airtel.in) [122.187.229.80]:56638: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-31 07:36:45 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:45585: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/images/sliders/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-01-31 07:36:54 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:49134: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:37:07 dovecot_login authenticator failed for H=(4JuSROz) [178.16.54.138]:60543: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:37:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 07:37:55 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:52298: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:37:11 dovecot_login authenticator failed for H=(G6uXuF1) [158.94.209.22]:58558: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:37:48 dovecot_login authenticator failed for H=(Th4bxr) [158.94.209.22]:62379: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:38:10 dovecot_login authenticator failed for H=(wicEvWaA) [178.16.54.138]:53174: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.193.139
country_id: 1814991
description:
2026-01-31 07:38:46 dovecot_login authenticator failed for H=([119.36.194.248]) [119.36.193.139]:35824: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-31 07:38:49 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:43089: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:38:05 dovecot_login authenticator failed for H=(S94F4CzXv7) [158.94.209.22]:58090: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-31 07:38:09 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:57238: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-31 07:38:17 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:60868: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 07:38:36 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:44268: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.111.3.59
country_id: 2017370
description:
2026-01-31 07:38:55 dovecot_login authenticator failed for H=(noname.vdonsk.ru) [193.111.3.59]:54332: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:38:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.75.186
country_id: 1835841
description:
2026-01-31 07:38:57 dovecot_login authenticator failed for H=([59.6.75.186]) [59.6.75.186]:59246: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 07:39:03 dovecot_login authenticator failed for H=(syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:58700: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 07:39:59 dovecot_login authenticator failed for H=(IWCHDj) [158.94.208.110]:65063: 535 Incorrect authentication data (set_id=audrey@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:39:04 dovecot_login authenticator failed for H=(qa9UhBqLch) [178.16.54.138]:57394: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 07:39:09 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:48070: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:39:17 dovecot_login authenticator failed for H=(cxURDyS) [158.94.209.22]:61002: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-01-31 07:39:19 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:59808: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.118.203
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=5 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:39:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:39:54 dovecot_login authenticator failed for H=(KUIFetQ) [158.94.209.22]:61803: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-31 07:40:09 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:38628: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:40:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:40:11 dovecot_login authenticator failed for H=(i0Q5TbGx) [158.94.209.22]:52936: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:40:09 dovecot_login authenticator failed for H=(4YpdfCqtH) [178.16.54.138]:51344: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 07:40:23 dovecot_login authenticator failed for H=(BtUJNUrq1w) [158.94.208.110]:52721: 535 Incorrect authentication data (set_id=audrey@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.31.62
country_id: 3625428
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1191009474.jpg&size=1000x1000 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
country_id: 6252001
description:
2026-01-31 07:40:44 dovecot_login authenticator failed for H=syn-024-097-133-002.biz.spectrum.com [24.97.133.2]:61047: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.158
country_id: 2750405
description:
2026-01-31  7:40:56 21304 [Warning] Aborted connection 21304 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.184.182
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=212395 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 07:41:11 dovecot_login authenticator failed for H=(hmxsnMBjjM) [158.94.208.110]:60465: 535 Incorrect authentication data (set_id=audrey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:42:00 dovecot_login authenticator failed for H=(Ih13z7) [158.94.209.22]:56946: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:41:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:41:05 dovecot_login authenticator failed for H=(dWqyW5SH5B) [158.94.209.22]:58469: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:41:06 dovecot_login authenticator failed for H=(I5uPifa9RT) [178.16.54.138]:61607: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:42:32 dovecot_login authenticator failed for H=(svaTy9Huu2) [178.16.54.138]:62763: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:42:17 dovecot_login authenticator failed for H=(W6JZGq8w3) [158.94.209.22]:50954: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.96.11.230
country_id: 2510769
description:
2026-01-31 07:43:24 dovecot_login authenticator failed for H=230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:46439: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:43:05 dovecot_login authenticator failed for H=(eI1oyg) [178.16.54.138]:61562: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.180.68.241
country_id: 660013
description:
2026-01-31 07:43:33 dovecot_login authenticator failed for H=static.241.68.180.157.clients.your-server.de (localhost) [157.180.68.241]:56711: 535 Incorrect authentication data (set_id=info@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:43:11 dovecot_login authenticator failed for H=(UAeLcXYKKT) [158.94.209.22]:52873: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-01-31 07:43:35 dovecot_login authenticator failed for H=([218.233.182.39]) [218.233.182.39]:8926: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:44:06 dovecot_login authenticator failed for H=(CJFqodJ6HA) [158.94.209.22]:55399: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: achieversvisionacademy.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/achieversvisiona/public_html/wp-admin/images/file.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-01-31 07:44:49 dovecot_login authenticator failed for H=([14.96.29.14]) [14.96.29.14]:55564: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.158
country_id: 1269750
description:
2026-01-31 07:44:58 dovecot_login authenticator failed for H=([152.52.238.138]) [59.145.160.158]:47336: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:44:16 dovecot_login authenticator failed for H=(qSmR5Lv7) [178.16.54.138]:57348: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:44:05 dovecot_login authenticator failed for H=(FuPTeZecb5) [158.94.209.22]:51712: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:44:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:45:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2026-01-31 07:45:32 dovecot_login authenticator failed for H=([60.172.1.210]) [60.172.1.210]:43638: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-31 07:45:52 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:41274: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:45:05 dovecot_login authenticator failed for H=(rlJHlBD5f) [178.16.54.138]:61129: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/kimmark/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:45:17 dovecot_login authenticator failed for H=(RLTH0By81H) [158.94.209.22]:49801: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2026-01-31 07:45:20 dovecot_login authenticator failed for H=([193.23.199.238]) [193.23.199.238]:44932: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: nmahir.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/nmahirc/public_html/wp-content||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:46:12 dovecot_login authenticator failed for H=(tyA9uLKOyD) [158.94.209.22]:64323: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:46:17 dovecot_login authenticator failed for H=(dJOS13GK) [178.16.54.138]:57442: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-01-31 07:46:28 dovecot_login authenticator failed for H=([60.8.73.174]) [60.8.73.174]:45526: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 07:46:12 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:56483: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.27
country_id: 6251999
description:
2026-01-31 07:46:21 dovecot_plain authenticator failed for H=([10.25.18.32]) [37.120.205.27]:21936: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.102.172.7
country_id: 2750405
description:
2026-01-31 07:46:55 dovecot_plain authenticator failed for H=217-102-172-7.cable.dynamic.v4.ziggo.nl (P756S1ACH72QLPV) [217.102.172.7]:56335: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:46:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2026-01-31 07:46:11 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:36578: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:46:11 dovecot_login authenticator failed for H=(6UCjKLfDRD) [158.94.209.22]:60383: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 07:46:57 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:32832: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-01-31 07:47:00 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:52354: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.102.172.7
country_id: 2750405
description:
2026-01-31 07:47:02 dovecot_login authenticator failed for H=217-102-172-7.cable.dynamic.v4.ziggo.nl (P756S1ACH72QLPV) [217.102.172.7]:56335: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:47:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:47:16 dovecot_login authenticator failed for H=(E1fYFKLHw) [178.16.54.138]:58736: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2026-01-31 07:47:42 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:34214: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2026-01-31 07:48:00 dovecot_login authenticator failed for H=([60.174.86.4]) [60.174.86.4]:33872: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:47:05 dovecot_login authenticator failed for H=(ijt5lC) [158.94.209.22]:60928: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.130.146.31
country_id: 6251999
description:
2026-01-31 07:47:09 dovecot_login authenticator failed for H=31.146.130.34.bc.googleusercontent.com (10.188.0.2) [34.130.146.31]:53052: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-31 07:47:21 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:57414: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-01-31 07:47:50 dovecot_login authenticator failed for H=([116.171.27.248]) [116.171.27.248]:49294: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 07:48:08 H=(localhost.localdomain) [78.153.140.207]:37336 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:48:17 dovecot_login authenticator failed for H=(vEZtFsLtK) [158.94.209.22]:54792: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 07:48:19 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:45028: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:48:06 dovecot_login authenticator failed for H=(NiyKMfM) [178.16.54.138]:56316: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-31 07:48:11 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:49910: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 07:48:30 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:14366: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:48:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:48:18 dovecot_login authenticator failed for H=(TsS6yCW) [158.94.209.22]:59138: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-31 07:49:30 dovecot_login authenticator failed for H=([27.123.119.219]) [182.95.226.118]:43356: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:49:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:49:11 dovecot_login authenticator failed for H=(E7qt1Re) [178.16.54.138]:54219: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.112.81
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.210.56.216
country_id: 6252001
description:
2026-01-31 07:49:18 dovecot_login authenticator failed for H=108-210-56-216.lightspeed.dctril.sbcglobal.net ([127.0.0.1]) [108.210.56.216]:51416: 535 Incorrect authentication data (set_id=info@indfinitydesign.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2026-01-31 07:49:46 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:41518: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:49:11 dovecot_login authenticator failed for H=(4x55bEZkDa) [158.94.209.22]:54917: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-01-31 07:49:43 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:56030: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2026-01-31 07:50:43 dovecot_login authenticator failed for H=h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:55716: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:50:07 dovecot_login authenticator failed for H=(eybZJmlbRd) [178.16.54.138]:58732: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:50:24 dovecot_login authenticator failed for H=(RCG3VU6m) [158.94.209.22]:50014: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.8.170
country_id: 2017370
description:
2026-01-31 07:50:06 dovecot_login authenticator failed for H=([31.173.8.170]) [31.173.8.170]:57980: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.53.37.67
country_id: 1562822
description:
2026-01-31 07:50:49 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [101.53.37.67]:50897: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:50:05 dovecot_login authenticator failed for H=(lzHEWBYM) [158.94.209.22]:51174: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.36.22
country_id: 1835841
description:
2026-01-31 07:50:23 dovecot_login authenticator failed for H=([125.61.36.25]) [125.61.36.22]:55664: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-01-31 07:50:14 dovecot_login authenticator failed for H=([120.234.232.184]) [120.234.232.184]:63436: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-31 07:50:52 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:49272: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2026-01-31 07:51:05 dovecot_login authenticator failed for H=(syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:54558: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:51:17 dovecot_login authenticator failed for H=(i65el6z) [158.94.209.22]:65450: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:51:29 dovecot_login authenticator failed for H=(E71J3uiv) [178.16.54.138]:64390: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:52:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:52:11 dovecot_login authenticator failed for H=(VweUVXI) [158.94.209.22]:62430: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.161.43
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73301515047031 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: vtgroupsb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/vtgroupsb/public_html/images||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:52:30 dovecot_login authenticator failed for H=(q26aRjkJe) [158.94.209.22]:52806: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:52:02 dovecot_login authenticator failed for H=(2ruKyH) [178.16.54.138]:64124: 535 Incorrect authentication data (set_id=jc@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:53:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:53:05 dovecot_login authenticator failed for H=(9M9lLTigL) [158.94.209.22]:51066: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:53:26 dovecot_login authenticator failed for H=(OvUlZxEdS7) [178.16.54.138]:63334: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 07:53:57 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ainthets) [87.103.126.54]:56058: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2026-01-31 07:53:19 dovecot_login authenticator failed for H=([178.178.194.192]) [178.178.194.192]:47850: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-31 07:53:34 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:49040: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 07:53:50 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:56234: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 07:53:54 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 07:54:05 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:58609: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:54:36 dovecot_login authenticator failed for H=(7A5GSqRcDd) [158.94.209.22]:58776: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.156.217.77
country_id: 1814991
description:
2026-01-31 07:55:00 dovecot_login authenticator failed for H=([61.156.217.77]) [61.156.217.77]:4712: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:54:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 07:54:05 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:43404: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:54:17 dovecot_login authenticator failed for H=(MYJI8cKSi) [158.94.209.22]:53896: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:54:23 dovecot_login authenticator failed for H=(NKIZxa0x) [178.16.54.138]:59675: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:55:11 dovecot_login authenticator failed for H=(4yVcPps) [158.94.209.22]:51959: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2026-01-31 07:55:13 dovecot_login authenticator failed for H=(066249.telemar.net.br) [200.216.172.182]:60034: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:55:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:55:30 dovecot_login authenticator failed for H=(vsNxTd8) [178.16.54.138]:61393: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:56:05 dovecot_login authenticator failed for H=(XxS4Pwksfo) [158.94.209.22]:63450: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:56:06 dovecot_login authenticator failed for H=(AmhkF5) [178.16.54.138]:61107: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:56:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:56:42 dovecot_login authenticator failed for H=(2d4Atg) [158.94.209.22]:59530: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:57:18 dovecot_login authenticator failed for H=(TXsxEEEyVl) [158.94.209.22]:62277: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:57:50 dovecot_login authenticator failed for H=(KXDqTG) [178.16.54.138]:57317: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 58.246.149.251
country_id: 1814991
description:
2026-01-31  7:57:36 21915 [Warning] Aborted connection 21915 to db: 'unconnected' user: 'unauthenticated' host: '58.246.149.251' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 58.246.149.251
country_id: 1814991
description:
2026-01-31  7:57:41 21928 [Warning] Aborted connection 21928 to db: 'unconnected' user: 'unauthenticated' host: '58.246.149.251' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:57:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jecyl@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-01-31 07:58:00 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:33321: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-31 07:58:36 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:58:48 dovecot_login authenticator failed for H=(7DtLt6qec) [158.94.209.22]:55423: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 07:58:09 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:60221: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:58:12 dovecot_login authenticator failed for H=(5wSnHDSO) [158.94.209.22]:64038: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.232.146
country_id: 1835841
description:
2026-01-31 07:58:23 dovecot_login authenticator failed for H=([220.80.232.146]) [220.80.232.146]:54847: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:58:23 dovecot_login authenticator failed for H=(iYBqPe) [178.16.54.138]:56135: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 07:58:56 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:1606: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.13
country_id: 2264397
description:
2026-01-31 07:58:03 dovecot_login authenticator failed for H=(ADMIN) [146.70.59.13]:57864: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:58:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jecyl@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2026-01-31 07:58:38 dovecot_login authenticator failed for H=([180.94.75.102]) [180.94.75.102]:52478: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: rcct.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/rcct/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 07:59:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 07:59:06 dovecot_login authenticator failed for H=(jBg2CVf) [158.94.209.22]:65293: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 07:59:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jecyl@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 07:59:33 dovecot_login authenticator failed for H=(lCshpv) [178.16.54.138]:63232: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:00:13 dovecot_login authenticator failed for H=(E13Ct9y4VX) [178.16.54.138]:50659: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:00:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-31 08:00:21 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:33316: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:00:18 dovecot_login authenticator failed for H=(cB1pB9VH) [158.94.209.22]:59480: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.141
country_id: 3469034
description:
2026-01-31 08:00:36 dovecot_login authenticator failed for H=(centrodenefrologia.static.gvt.net.br) [177.207.248.141]:52994: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 08:00:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jecyl@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:00:54 dovecot_login authenticator failed for H=(X4QavV) [158.94.209.22]:55518: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:01:12 dovecot_login authenticator failed for H=(nnvYYqKQB) [158.94.209.22]:58666: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:01:21 dovecot_login authenticator failed for H=(sMsYZo22) [178.16.54.138]:61226: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:01:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 08:01:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account jecyl@stonewld.com.my has been locked for the attacker IP 178.16.54.138


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.135.133.55
country_id: 3439705
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/products.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:02:27 dovecot_login authenticator failed for H=(xr5wPY) [178.16.54.138]:65325: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 08:02:42 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:12737: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 58.246.149.251
country_id: 1814991
description:
2026-01-31  8:02:42 22085 [Warning] Aborted connection 22085 to db: 'unconnected' user: 'unauthenticated' host: '58.246.149.251' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.250.182.141
country_id: 1814991
description:
2026-01-31 08:02:57 dovecot_login authenticator failed for H=([118.250.182.141]) [118.250.182.141]:55134: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 08:03:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (twania) [87.103.126.54]:27736: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:02:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 58.246.149.251
country_id: 1814991
description:
2026-01-31  8:02:47 22099 [Warning] Aborted connection 22099 to db: 'unconnected' user: 'unauthenticated' host: '58.246.149.251' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:03:00 dovecot_login authenticator failed for H=(1Sc7ueJ) [158.94.209.22]:52371: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:02:06 dovecot_login authenticator failed for H=(egoZbX) [158.94.209.22]:65272: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.221.99.191
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=678166 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 08:02:16 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:58090: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:03:32 dovecot_login authenticator failed for H=(YR1D11u) [178.16.54.138]:58182: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-31 08:03:48 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:60236: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 08:03:57 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:34528: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-01-31 08:03:14 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:55430: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:03:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:03:18 dovecot_login authenticator failed for H=(r0ry8sd65Z) [158.94.209.22]:49566: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 08:03:29 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:26630: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:04:04 dovecot_login authenticator failed for H=(RuzALF4) [178.16.54.138]:52887: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:04:12 dovecot_login authenticator failed for H=(hRcubKcO) [158.94.209.22]:60255: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.180.136.250
country_id: 6252001
description:
Jan 31 08:04:41 sv3 pure-ftpd[3879853]: (?@52.180.136.250) [INFO] New connection from 52.180.136.250


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:04:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:05:06 dovecot_login authenticator failed for H=(WqiR6wVI) [158.94.209.22]:58435: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:05:11 dovecot_login authenticator failed for H=(ocqFp5) [178.16.54.138]:64523: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: ds-staffing.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/dsstaffing/public_html/assets||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:05:06 dovecot_login authenticator failed for H=(MDtw4hotw) [158.94.209.22]:58402: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:06:18 dovecot_login authenticator failed for H=(U7KetnZ) [158.94.209.22]:55546: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: smartcable.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/smartcable/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 08:06:28 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:56544: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:06:35 dovecot_login authenticator failed for H=(i66yxs4) [178.16.54.138]:52634: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2026-01-31 08:07:07 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:55910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:07:12 dovecot_login authenticator failed for H=(1PdvJEcLaF) [158.94.209.22]:51752: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:07:12 dovecot_login authenticator failed for H=(3jnrK5SjJz) [158.94.209.22]:51723: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:07:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: autodiscover.mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:07:08 dovecot_login authenticator failed for H=(mrZ2Pwg) [178.16.54.138]:50589: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-01-31 08:07:30 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:33369: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:08:06 dovecot_login authenticator failed for H=(1tZFmn0) [158.94.209.22]:62466: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: autodiscover.mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:08:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:08:46 dovecot_login authenticator failed for H=(sxAPOKzjr) [178.16.54.138]:52288: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:09:18 dovecot_login authenticator failed for H=(mwVMal) [158.94.209.22]:60765: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:09:18 dovecot_login authenticator failed for H=(XPHHxsHk) [158.94.209.22]:60753: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-01-31 08:09:21 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:63620: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2026-01-31 08:09:51 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:54670: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-31 08:09:06 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:49492: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:09:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:09:22 dovecot_login authenticator failed for H=(RmzUuOQss) [178.16.54.138]:57679: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:10:33 dovecot_login authenticator failed for H=(8mc7fxgIP) [178.16.54.138]:50945: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-01-31 08:10:43 dovecot_login authenticator failed for H=([115.248.4.85]) [115.248.4.85]:65527: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:10:12 dovecot_login authenticator failed for H=(M8mIDP3) [158.94.209.22]:54694: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:10:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-31 08:10:28 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:40172: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:11:08 dovecot_login authenticator failed for H=(m3RE8l3) [178.16.54.138]:62204: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:11:24 dovecot_login authenticator failed for H=(jN72Jt4NP) [158.94.209.22]:53286: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:11:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:11:06 dovecot_login authenticator failed for H=(Ppxq8w) [158.94.209.22]:57656: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.24.41.71
country_id: 2017370
description:
2026-01-31 08:12:59 dovecot_login authenticator failed for H=pppoe-41-071.prtcom.ru [78.24.41.71]:57964: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:12:17 dovecot_login authenticator failed for H=(rMPG1J) [178.16.54.138]:57497: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:12:18 dovecot_login authenticator failed for H=(e0OLl4mYV) [158.94.209.22]:60853: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:12:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-01-31 08:13:53 dovecot_login authenticator failed for H=(isnU8T) [45.92.33.82]:59855: 535 Incorrect authentication data (set_id=mohamad-amir.hashim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.239.150.15
country_id: 3996063
description:
2026-01-31 08:13:10 dovecot_login authenticator failed for H=(170-239-150-15.internet.ientc.net.mx) [170.239.150.15]:60220: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:13:12 dovecot_login authenticator failed for H=(TN2XPOPh) [158.94.209.22]:58384: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 08:13:28 dovecot_login authenticator failed for H=(DxUbOTckW) [178.16.54.138]:51567: 535 Incorrect authentication data (set_id=jecyl@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:13:30 dovecot_login authenticator failed for H=(6IPe9KA) [158.94.209.22]:65479: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2026-01-31 08:13:59 dovecot_login authenticator failed for H=([128.185.101.201]) [122.185.146.18]:45084: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-01-31 08:14:12 dovecot_login authenticator failed for H=(JRrqZ9yuJ) [45.92.33.82]:61238: 535 Incorrect authentication data (set_id=mohamad-amir.hashim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-31 08:14:49 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:43719: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.165.76
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=3087 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-01-31 08:14:06 dovecot_login authenticator failed for H=([182.95.116.66]) [182.95.116.66]:39514: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:14:06 dovecot_login authenticator failed for H=(D16KsQZ) [158.94.209.22]:53462: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:15:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 223.199.169.30
country_id: 1814991
description:
Jan 31 08:15:04 sv3 pure-ftpd[3886732]: (?@223.199.169.30) [INFO] New connection from 223.199.169.30


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-31 08:15:15 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:53279: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:15:36 dovecot_login authenticator failed for H=(OUdWbqiGWB) [158.94.209.22]:57637: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-31 08:15:46 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:38233: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2026-01-31 08:15:11 dovecot_login authenticator failed for H=(71xd2wmbEC) [45.92.33.82]:60843: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:15:18 dovecot_login authenticator failed for H=(06NZsMA) [158.94.209.22]:52994: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 08:16:31 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:59791: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:16:12 dovecot_login authenticator failed for H=(Y8GWM2) [158.94.209.22]:60771: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-31 08:16:18 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:52835: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.239.206
country_id: 1814991
description:
2026-01-31 08:16:02 dovecot_login authenticator failed for H=([220.189.239.206]) [220.189.239.206]:48304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:16:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-01-31 08:16:58 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:44026: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2026-01-31 08:17:20 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:32771: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:17:42 dovecot_login authenticator failed for H=(93TgdwJ) [158.94.209.22]:55478: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:17:06 dovecot_login authenticator failed for H=(60c2OWlQgw) [158.94.209.22]:50672: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-31 08:17:11 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:55438: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2026-01-31 08:17:47 dovecot_login authenticator failed for H=([1.235.192.130]) [1.235.192.130]:57238: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:17:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:18:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: aoto.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/aotocom/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 08:18:44 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:51985: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-31 08:18:24 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:34796: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:18:19 dovecot_login authenticator failed for H=(xm2T71uZxD) [158.94.209.22]:65230: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 08:18:32 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:30284: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 08:18:40 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:52628: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:19:49 dovecot_login authenticator failed for H=(Jnn6gMmUuO) [158.94.209.22]:65155: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.128.210
country_id: 1814991
description:
2026-01-31 08:19:50 dovecot_login authenticator failed for H=([221.235.182.76]) [61.184.128.210]:36071: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
country_id: 1814991
description:
2026-01-31 08:19:37 dovecot_login authenticator failed for H=([220.172.203.43]) [220.172.203.43]:52058: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.250.213.157
country_id: 2017370
description:
2026-01-31 08:19:46 dovecot_login authenticator failed for H=([89.250.213.157]) [89.250.213.157]:58084: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.189.70
country_id: 6252001
description:
2026-01-31 08:20:01 dovecot_login authenticator failed for H=([166.141.189.70]) [166.141.189.70]:40443: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:19:13 dovecot_login authenticator failed for H=(87WMpQZuv) [158.94.209.22]:49844: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:19:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-31 08:19:20 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:58458: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: vc-b.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/vcbcom/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 08:20:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthnam has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:20:07 dovecot_login authenticator failed for H=(8QOMhAP1) [158.94.209.22]:50098: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2026-01-31 08:20:11 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:3984: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.161
country_id: 1831722
description:
[2026-01-31 08:20:40 +0800] info [cpaneld] 160.202.35.161 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-01-31 08:20:44 dovecot_login authenticator failed for H=([65.20.143.159]) [65.20.143.159]:38734: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.54.82
country_id: 1269750
description:
2026-01-31 08:20:34 dovecot_login authenticator failed for H=(dsl-tn-dynamic-201.116.246.61.airtelbroadband.in) [122.187.54.82]:44002: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 111.78.105.254
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 115.153.11.10
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.234.211
country_id: 1814991
domain: www.oxbold.com
description:


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:21:55 dovecot_login authenticator failed for H=(DHKezrUX) [158.94.209.22]:57149: 535 Incorrect authentication data (set_id=shamini.velayuthan)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.6.87
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.30.109
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.98.61.142
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 220.175.85.50
country_id: 1814991
domain: www.oxbold.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.72.200
country_id: 2017370
description:
2026-01-31 08:22:00 dovecot_login authenticator failed for H=broadband-188-32-72-200.ip.moscow.rt.ru [188.32.72.200]:53802: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 111.76.46.167
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.20.90
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.165.36
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.164.161
country_id: 1814991
domain: www.oxbold.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.85.175.110
country_id: 1814991
domain: www.oxbold.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.81
country_id: 1668284
description:
2026-01-31 08:21:51 dovecot_login authenticator failed for H=(ADMIN) [173.244.49.81]:12249: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:21:19 dovecot_login authenticator failed for H=(cXztUzibD2) [158.94.209.22]:60271: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 08:22:13 dovecot_login authenticator failed for H=(oa8Rqd) [158.94.209.22]:59896: 535 Incorrect authentication data (set_id=shamini.velayuthnam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.117
country_id: 1814991
description:
2026-01-31 08:22:18 dovecot_login authenticator failed for H=([111.26.106.117]) [111.26.106.117]:42318: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-31 08:22:13 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:34150: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-01-31 08:22:49 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:62100: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.90.120.53
country_id: 1814991
description:
2026-01-31 08:22:16 dovecot_login authenticator failed for H=([218.90.120.53]) [218.90.120.53]:43366: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


