# incident

plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:17:54 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-31 14:17:20 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:41167: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-01-31 14:17:23 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:33866: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-01-31 14:17:05 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:17:02 dovecot_login authenticator failed for H=(ZnfnLs) [158.94.209.22]:52974: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-01-31 14:17:32 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:39620: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 14:17:50 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:43450: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:18:10 dovecot_login authenticator failed for H=(QjaywtYwW0) [165.154.235.118]:26593: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:18:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:18:04 dovecot_login authenticator failed for H=(05OdjZav5) [158.94.208.175]:55284: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2026-01-31 14:18:27 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:61453: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:18:14 dovecot_login authenticator failed for H=(CKuEYzOPIH) [158.94.209.22]:59007: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:18:21 dovecot_login authenticator failed for H=(dQPxQ1) [165.154.235.118]:30837: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:18:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:18:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 14:18:29 dovecot_login authenticator failed for H=(O8YZQ3rh) [185.91.69.136]:57294: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:18:03 dovecot_login authenticator failed for H=(CAyYMI3) [178.16.54.138]:50300: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:309771356046a06712a0ee55fd984e7387f5c9a3||Title:0xc44fad15||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:19:08 dovecot_login authenticator failed for H=(q5kdBAG) [158.94.209.22]:63546: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:19:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:19:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:19:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:19:06 dovecot_login authenticator failed for H=(CjbKxLo) [165.154.235.118]:47473: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:19:25 dovecot_login authenticator failed for H=(cOPz9XALM) [178.16.54.138]:58194: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 14:19:37 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:58130: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:19:22 dovecot_login authenticator failed for H=(GUtQqV3v) [158.94.208.175]:61563: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 14:19:41 dovecot_login authenticator failed for H=(456xFdDNlA) [185.91.69.136]:60649: 535 Incorrect authentication data (set_id=azakaria.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 14:20:26 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:34814: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:20:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 14:20:15 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:38898: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:20:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:20:02 dovecot_login authenticator failed for H=(14IG7p) [165.154.235.118]:5697: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30529bbdcfcafde35b5ab2a09a38aea0a22f092f||Title:0x98756fad||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:20:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 14:20:21 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:39418: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:20:58 dovecot_login authenticator failed for H=(UkQb5BbM) [165.154.235.118]:28349: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:20:02 dovecot_login authenticator failed for H=(Vf6VtlMzv) [158.94.209.22]:51554: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:20:15 dovecot_login authenticator failed for H=(ci2nbQ) [178.16.54.138]:65510: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:20:17 dovecot_login authenticator failed for H=(OIASHf) [158.94.208.175]:49482: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-31 14:21:10 dovecot_login authenticator failed for H=(ni2MMx) [165.154.235.118]:33088: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-01-31 14:21:59 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:50117: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:21:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:21:16 dovecot_login authenticator failed for H=(gGfTm1) [158.94.208.175]:53180: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bbc54b8cb84230697e8fb42b1b9124c9d73b5714||Title:0x2a93e678||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:21:10 dovecot_login authenticator failed for H=(gSo37Y3cC) [178.16.54.138]:65458: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:21:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:21:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:21:14 dovecot_login authenticator failed for H=(2z0V3WvE) [158.94.209.22]:57612: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:22:04 dovecot_login authenticator failed for H=(HbHhIDhLXf) [178.16.54.138]:58502: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:22:13 dovecot_login authenticator failed for H=(baCzjmBy) [158.94.208.175]:59754: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 14:22:16 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:50082: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:56dc3feaa22843cddc669dc8d21a7a51b0471fba||Title:0xd463f2eb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-01-31 14:22:52 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:38610: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 31 14:22:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ohchan.vpb@vc-b.com.my has been locked for the attacker IP 178.16.54.138


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:22:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:22:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:22:08 dovecot_login authenticator failed for H=(ExZcqlZG) [158.94.209.22]:62027: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 14:23:04 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:39074: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40809ac9f7c8cf1b88505b618dae3fbdc84c21d0||Title:0xd20a48b2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:23:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:23:12 dovecot_login authenticator failed for H=(IabHfmuHwW) [158.94.208.175]:51712: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.119.135
country_id: 1210997
description:
2026-01-31 14:23:28 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [103.106.119.135]:57972: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:23:25 dovecot_login authenticator failed for H=(ZKm1kz) [178.16.54.138]:56621: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:23:02 dovecot_login authenticator failed for H=(TXwbdU) [158.94.209.22]:50131: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:24:42 dovecot_login authenticator failed for H=(g0EYgx) [158.94.209.22]:59280: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3c940035a8e3ee7500f5e15529e876346d0c602c||Title:0x256fdb14||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:24:14 dovecot_login authenticator failed for H=(9ExC7MAWB) [158.94.209.22]:56098: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.18.34.152
country_id: 1643084
description:
2026-01-31 14:24:59 dovecot_plain authenticator failed for H=(D5USN7IUSI1V) [103.18.34.152]:53137: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:24:10 dovecot_login authenticator failed for H=(uziLqj2) [158.94.208.175]:61848: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:24:22 dovecot_login authenticator failed for H=(ZfTy833) [178.16.54.138]:61012: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:25:11 dovecot_login authenticator failed for H=(t4bFeLGLBz) [158.94.209.22]:60688: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2026-01-31 14:25:17 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:24926: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:25:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 14:25:39 dovecot_login authenticator failed for H=([182.95.215.92]) [122.186.255.50]:58648: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:25:06 dovecot_login authenticator failed for H=(vEFg3Xl6is) [158.94.208.175]:57394: 535 Incorrect authentication data (set_id=scchee.vcb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 14:25:16 dovecot_login authenticator failed for H=(71A34eW) [178.16.54.138]:57683: 535 Incorrect authentication data (set_id=ohchan.vpb@vc-b.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.116
country_id: 6252001
description:
2026-01-31 14:25:44 37206 [Warning] Aborted connection 37206 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.116' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:79bc6d6113cf764718720e238b1b872614b8dda8||Title:0x12505c45||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.18.34.152
country_id: 1643084
description:
2026-01-31 14:25:05 dovecot_login authenticator failed for H=(D5USN7IUSI1V) [103.18.34.152]:53137: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:26:18 dovecot_login authenticator failed for H=(OpuHW2cw) [158.94.208.175]:62561: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2026-01-31 14:26:46 dovecot_login authenticator failed for H=([218.75.123.109]) [183.247.171.186]:40101: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-31 14:26:17 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:58369: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-31 14:26:20 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (sulands) [73.144.27.228]:55788: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 14:26:03 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:54135: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:26:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:26:05 dovecot_login authenticator failed for H=(DYooErn) [158.94.209.22]:65106: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2026-01-31 14:26:54 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:53576: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:27:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2fa37162a03f6e99a0c7286ea7089bb28be0591b||Title:0x3568cb84||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:27:17 dovecot_login authenticator failed for H=(fSpvOyVU97) [158.94.209.22]:54517: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 14:27:32 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:57699: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:27:04 dovecot_login authenticator failed for H=(bKoZ2uT2) [158.94.208.175]:57438: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:27:54 dovecot_login authenticator failed for H=(QNxOsn) [158.94.208.175]:52380: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 14:27:58 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:43420: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.0.216
country_id: 1835841
description:
2026-01-31 14:28:46 dovecot_login authenticator failed for H=([118.60.136.49]) [183.107.0.216]:46948: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-31 14:29:00 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:50038: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:28:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:28:10 dovecot_login authenticator failed for H=(JG2dPTX1n) [158.94.208.175]:63807: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:28:11 dovecot_login authenticator failed for H=(2vFT29G) [158.94.209.22]:58894: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:45f717568d5ce47dbcc0b012e0853e8fbb4a4dff||Title:0x5f7013f4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2026-01-31 14:28:43 dovecot_login authenticator failed for H=([49.124.151.14]) [49.124.151.14]:51830: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:475943e341eafd4b7000c36661efd34b52a645d5||Title:0xeac3ba4b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:29:05 dovecot_login authenticator failed for H=(X4hbkswy) [158.94.209.22]:63084: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:29:02 dovecot_login authenticator failed for H=(vMcYRK2Ht) [158.94.208.175]:62607: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:29:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-31 14:30:56 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:43300: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.222.180
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/gcb-product.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31 14:30:47 37413 [Warning] Aborted connection 37413 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2026-01-31 14:31:00 dovecot_login authenticator failed for H=([111.171.125.94]) [111.171.125.94]:37602: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:30:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:30:20 dovecot_login authenticator failed for H=(fefocZ) [158.94.208.175]:57474: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2436c3ccf45e0da1675f6d8ac7c2ffb7eea4f168||Title:0x42f74077||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:30:17 dovecot_login authenticator failed for H=(kTPGOpv) [158.94.209.22]:52407: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:31:11 dovecot_login authenticator failed for H=(w0lzkoWqC2) [158.94.209.22]:56684: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bcb19d8291d220f54e49eea623ba8300fa760225||Title:0xf163c887||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:31:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 14:31:02 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:21863: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-31 14:31:07 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:59198: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:31:18 dovecot_login authenticator failed for H=(z0limQg) [158.94.208.175]:60657: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.53
country_id: 1668284
description:
2026-01-31 14:31:26 dovecot_login authenticator failed for H=111-70-32-53.emome-ip.hinet.net [111.70.32.53]:36910: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:31:45 dovecot_login authenticator failed for H=(dPvVlVGrk0) [141.98.11.48]:61412: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:32:05 dovecot_login authenticator failed for H=(oRwyxRSAO) [158.94.209.22]:60861: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:32:06 dovecot_login authenticator failed for H=(uXvW0duDo4) [158.94.208.175]:54547: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:32:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:32:19 dovecot_login authenticator failed for H=(bjsArAiM) [141.98.11.48]:55097: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:32:23 dovecot_login authenticator failed for H=(t81NdRwN) [158.94.209.22]:62315: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 14:33:01 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:55336: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:655b05d6d35dc5442665626dcf479540560c4a65||Title:0xd4c93c97||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:33:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:33:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:33:32 dovecot_login authenticator failed for H=(tK3A0z) [141.98.11.48]:56072: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.59.87
country_id: 1269750
description:
2026-01-31 14:33:44 dovecot_login authenticator failed for H=(abts-north-static-087.59.160.122.airtelbroadband.in) [122.160.59.87]:36386: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-31 14:33:53 +0800] info [cpaneld] 202.178.120.157 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:586790c4bd936b9b736c175d547c57a636da6aaf||Title:0x3ca55e41||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-01-31 14:33:43 dovecot_login authenticator failed for H=(aes-static-097.188.22.125.airtel.in) [122.184.118.126]:42146: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:33:07 dovecot_login authenticator failed for H=(4Z1UcJv9GS) [158.94.208.175]:53692: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:33:17 dovecot_login authenticator failed for H=(i1vXzi8To4) [158.94.209.22]:50161: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2026-01-31 14:33:35 dovecot_login authenticator failed for H=(nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:53876: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:34:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.17.213.162
country_id: 1814991
description:
2026-01-31 14:34:04 dovecot_login authenticator failed for H=([111.17.213.162]) [111.17.213.162]:49213: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:34:22 dovecot_login authenticator failed for H=(Qwpt7id) [158.94.208.175]:62764: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:75c14f2b06b6c95b865d5a23aeb047013ceacc92||Title:0x805cfd39||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:34:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:34:11 dovecot_login authenticator failed for H=(caeKR728) [158.94.209.22]:54315: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:34:22 dovecot_login authenticator failed for H=(geDrpJ) [141.98.11.48]:56195: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:35:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:35:19 dovecot_login authenticator failed for H=(SxmXKAMS8A) [158.94.208.175]:63510: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:35:40 dovecot_login authenticator failed for H=(FQNGz3f) [158.94.208.175]:64278: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.140.231
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/fkrm-motor.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:35:38 dovecot_login authenticator failed for H=(3HRInQaswG) [141.98.11.48]:63926: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cabca5dfb9b6d9607b7ef3b0eca242a02f14f390||Title:0x06a38d82||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.7
country_id: 1522867
description:
2026-01-31 14:35:44 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.7]:61546: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:35:05 dovecot_login authenticator failed for H=(dmVXj4k) [158.94.209.22]:58437: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31 14:36:26 37601 [Warning] Aborted connection 37601 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2dd3dfdaba18970d9b24608293082765681f018c||Title:0xc88ce50e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 14:36:50 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:36822: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:36:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:36:17 dovecot_login authenticator failed for H=(o4bUpBJuIo) [158.94.209.22]:64000: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:36:12 dovecot_login authenticator failed for H=(Oe5qajL) [141.98.11.48]:65411: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-31 14:36:31 dovecot_login authenticator failed for H=([128.185.217.149]) [125.19.156.2]:54452: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:36:04 dovecot_login authenticator failed for H=(0LOvXsq) [158.94.208.175]:53384: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.241.77.78
country_id: 1269750
description:
2026-01-31 14:36:09 dovecot_login authenticator failed for H=([117.241.77.78]) [117.241.77.78]:51096: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:37:11 dovecot_login authenticator failed for H=(xjI3X52E) [158.94.209.22]:51618: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:37:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:37:10 dovecot_login authenticator failed for H=(7gXAFgK7) [158.94.208.175]:60265: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:37:30 dovecot_login authenticator failed for H=(4fNBHjMm) [141.98.11.48]:64505: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.85.194
country_id: 1814991
description:
2026-01-31 14:37:30 dovecot_login authenticator failed for H=([183.233.85.194]) [183.233.85.194]:47570: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d85c6d682f5369615d267aac73c3a1898628264c||Title:0xd4b7a3fd||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 14:37:03 dovecot_login authenticator failed for H=(syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:62933: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 14:37:25 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:35684: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-31 14:37:57 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:33816: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-31 14:38:17 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:33765: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:38:20 dovecot_login authenticator failed for H=(V8JebP1p0) [158.94.208.175]:56090: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 14:38:38 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:52795: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 14:38:59 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:36710: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:38:06 dovecot_login authenticator failed for H=(agtZlQt) [158.94.209.22]:55797: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:38:09 dovecot_login authenticator failed for H=(QWreyM) [141.98.11.48]:63791: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:30c67ff5f1dc90e2bde229fbb08173794c2b52e9||Title:0x73c5311b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:39:29 dovecot_login authenticator failed for H=(WuoUnP5fd) [141.98.11.48]:50746: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/photos/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26201385d38c1e25d90e709251307e8d5133a59a||Title:0x7cc602a8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2026-01-31 14:39:57 dovecot_login authenticator failed for H=([154.144.255.209]) [154.144.255.209]:41046: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 14:39:35 dovecot_plain authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it (unpliced) [188.219.104.210]:52312: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:39:17 dovecot_login authenticator failed for H=(WMkeUA) [158.94.208.175]:62025: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:39:18 dovecot_login authenticator failed for H=(wq9Sviv) [158.94.209.22]:61154: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:39:36 dovecot_login authenticator failed for H=(tY0mSkQ0O7) [158.94.209.22]:62486: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2026-01-31 14:40:30 dovecot_login authenticator failed for H=([128.185.194.190]) [128.185.194.190]:46104: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77350297
name: IM360 WAF: Block malware interaction requests (SMW-BLKH-1666099)
abuser: 221.120.162.90
country_id: 1831722
domain: www.oxbold.com
description:
IM360 WAF: Block malware interaction requests (SMW-BLKH-1666099)||MVN:REQUEST_FILENAME||SC:/home/oxboldc/public_html/.adminlogin.php||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-01-31 14:40:50 dovecot_login authenticator failed for H=([211.104.166.110]) [211.104.166.110]:45049: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:35ae88eac7840a8b4ca5ec154e660ab537829ad5||Title:0x99d3d7b0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:40:05 dovecot_login authenticator failed for H=(roadfJNQ) [141.98.11.48]:50830: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:40:12 dovecot_login authenticator failed for H=(krePLAyir) [158.94.209.22]:65144: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2026-01-31 14:40:22 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:55651: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:40:17 dovecot_login authenticator failed for H=(wecjdh2JYI) [158.94.208.175]:54835: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 221.120.162.90
country_id: 1831722
domain: www.oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/db.php.backup||User:oxboldc||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 14:40:13 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:51515: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-31 14:40:36 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:16750: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 221.120.162.90
country_id: 1831722
domain: www.oxbold.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:7.71||T:APACHE||MV:v6Vul6~||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.131.28
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=193141 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.134
country_id: 1269750
description:
2026-01-31 14:41:47 dovecot_login authenticator failed for H=([125.21.245.33]) [182.64.3.134]:44932: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:41:06 dovecot_login authenticator failed for H=(GNj1Yp) [158.94.209.22]:52809: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-31 14:41:31 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:35410: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f51f71ead2b120d65ca7f2654a42ef0e8789b405||Title:0x92e4871f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-31 14:42:00 H=([77.83.39.167]) [77.83.39.167]:62868 F=<stevenwelbou@op.pl> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.72.182
country_id: 1814991
description:
2026-01-31 14:41:27 dovecot_login authenticator failed for H=([58.222.72.182]) [58.222.72.182]:36279: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:41:32 dovecot_login authenticator failed for H=(3WdlfAzwE0) [141.98.11.48]:59207: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.5
country_id: 2635167
description:
2026-01-31 14:41:34 dovecot_plain authenticator failed for H=([10.5.18.73]) [158.173.23.5]:46451: 535 Incorrect authentication data (set_id=sixela2217@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-31 14:41:41 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:61186: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-01-31 14:41:01 dovecot_login authenticator failed for H=([101.13.4.124]) [101.13.4.124]:52964: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:41:19 dovecot_login authenticator failed for H=(Ldi96t) [158.94.208.175]:63220: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:41:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:42:08 dovecot_login authenticator failed for H=(oxYIRE2Z) [141.98.11.48]:61339: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:42:15 dovecot_login authenticator failed for H=(ZqqpQYrx) [158.94.208.175]:50905: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:42:18 dovecot_login authenticator failed for H=(l5ONtmpThK) [158.94.209.22]:58095: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f17de0db771756e840e7cc9c8a22b44dbb3698d9||Title:0x34d7bd8d||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.169.176
country_id: 2017370
description:
2026-01-31 14:42:03 dovecot_login authenticator failed for H=(31-220-169-176.rdtc.ru) [31.220.169.176]:55515: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.5
country_id: 2635167
description:
2026-01-31 14:42:04 dovecot_plain authenticator failed for H=([10.5.18.73]) [158.173.23.5]:1291: 535 Incorrect authentication data (set_id=sixela2217@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:42:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.66
country_id: 1269750
description:
2026-01-31 14:43:15 dovecot_login authenticator failed for H=([182.95.26.179]) [182.95.231.66]:58940: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:43:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-01-31 14:43:50 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:64273: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:43:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:43:18 dovecot_login authenticator failed for H=(UTYLBFsRT) [158.94.208.175]:60404: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea2fac00d4ef9415c91a6bdbbc60fb44e8c3be23||Title:0x759874d2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:43:04 dovecot_login authenticator failed for H=(tO9fF5) [141.98.11.48]:60484: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-01-31 14:43:29 dovecot_login authenticator failed for H=([103.187.78.189]) [103.187.78.189]:43290: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:43:12 dovecot_login authenticator failed for H=(RgqBFZd4) [158.94.209.22]:62095: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:43:18 dovecot_login authenticator failed for H=(qwPgwf2pQ) [158.94.208.175]:60392: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2026-01-31 14:43:07 dovecot_login authenticator failed for H=(74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:43217: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-31 14:44:50 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:53054: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7010ceab6da620823c37feba944ffc000e05bf2d||Title:0xb14ba8c3||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:44:05 dovecot_login authenticator failed for H=(HLpczslt) [158.94.208.175]:56007: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:44:06 dovecot_login authenticator failed for H=(XAESwua5Lv) [158.94.209.22]:49731: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:44:22 dovecot_login authenticator failed for H=(MhNkolzj) [141.98.11.48]:62589: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:44:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:44:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-31 14:44:42 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:56730: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-31 14:44:04 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:52954: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2026-01-31 14:45:58 dovecot_login authenticator failed for H=([85.117.232.42]) [85.117.232.42]:59173: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:45:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:45:36 dovecot_login authenticator failed for H=(K2LL62H) [158.94.209.22]:56270: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:45:03 dovecot_login authenticator failed for H=(TpRiauI) [158.94.208.175]:60218: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.53.109.153
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=656790 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:45:34 dovecot_login authenticator failed for H=(GXYL8U5) [141.98.11.48]:50617: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:45:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:45:18 dovecot_login authenticator failed for H=(WzgVSwT) [158.94.209.22]:54948: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:46:02 dovecot_login authenticator failed for H=(RthEoLo) [158.94.208.175]:52507: 535 Incorrect authentication data (set_id=scchee.vcb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.3.114
country_id: 1835841
description:
2026-01-31 14:46:45 dovecot_login authenticator failed for H=([119.207.3.114]) [119.207.3.114]:57864: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:46:23 dovecot_login authenticator failed for H=(arusbZz) [141.98.11.48]:59007: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:46:03 dovecot_login authenticator failed for H=(cJmhcx) [158.94.209.22]:59330: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-31 14:46:07 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:17358: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:46:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
country_id: 1814991
description:
2026-01-31 14:46:56 dovecot_login authenticator failed for H=([58.34.174.90]) [58.34.174.90]:45153: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c234e57303683e1a0ffa065f2fd4b7a88a219d9e||Title:0x81d3efdf||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07763b586f0222ff96926186d3fe22f3eb631778||Title:0xae6ba2ec||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.176.36
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=30 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.213
country_id: 1733045
description:
2026-01-31 14:47:08 dovecot_login authenticator failed for H=([49.124.152.213]) [49.124.152.213]:37062: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:47:45 dovecot_login authenticator failed for H=(ObDjURpI) [158.94.209.22]:50408: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:47:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:47:06 dovecot_login authenticator failed for H=(z3wqYNEzV) [158.94.209.22]:62850: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:47:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account scchee.vcb@vc-b.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:47:35 dovecot_login authenticator failed for H=(v10fco) [141.98.11.48]:63135: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:47:02 dovecot_login authenticator failed for H=(KykeEzJ50) [158.94.208.175]:49387: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:48:23 dovecot_login authenticator failed for H=(xuzFOVm) [141.98.11.48]:60682: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:48:07 dovecot_login authenticator failed for H=(PMkxOwvb) [158.94.209.22]:51681: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 14:48:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shutters@col.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 14:48:15 dovecot_login authenticator failed for H=(fn3aDO) [158.94.208.175]:65055: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: mckd.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/mckd/public_html/images/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:48:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:980a898c3f11762d60efcbcc64d43a410e6d1632||Title:0xf35b4e08||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:49:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:49:04 dovecot_login authenticator failed for H=(78UwO4Y) [158.94.209.22]:55831: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.60.175
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/paving-breaker.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:49:22 dovecot_login authenticator failed for H=(nhq4RI4A) [158.94.209.22]:56805: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cffad0faefe2d9509aa0f551625c5b189c3e88ed||Title:0x3d0eede1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:49:25 dovecot_login authenticator failed for H=(mLdrJwV) [141.98.11.48]:54584: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:50:47 dovecot_login authenticator failed for H=(az7ThN) [141.98.11.48]:50755: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f8eb5e629959b230d8ee8ccaa75f65045fa42320||Title:0x38091b69||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.30.248.213
country_id: 2017370
description:
2026-01-31 14:50:44 dovecot_login authenticator failed for H=broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:58584: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:50:16 dovecot_login authenticator failed for H=(lVk9305k) [158.94.209.22]:60239: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-31 14:50:36 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:42304: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:50:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 14:51:40 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:48198: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-31 14:52:01 dovecot_login authenticator failed for H=([122.4.199.164]) [122.4.199.164]:26122: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21d3193ba1e9687d088080ddf5724f1c63f7d384||Title:0xfc68f908||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:51:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:51:05 dovecot_login authenticator failed for H=(mG9Nbm9) [158.94.209.22]:64599: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.213.124.239
country_id: 3573591
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/market/289/621662 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:51:23 dovecot_login authenticator failed for H=(JvaN1lMTT) [141.98.11.48]:60477: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 14:52:57 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:55168: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.245.240.239
country_id: 6252001
description:
2026-01-31 14:52:35 38224 [Warning] Aborted connection 38224 to db: 'unconnected' user: 'unauthenticated' host: '157.245.240.239' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:52:46 dovecot_login authenticator failed for H=(eejeaoth) [158.94.209.22]:54639: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:52:10 dovecot_login authenticator failed for H=(RRAOjIxMtc) [158.94.209.22]:51995: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.245.131.154
country_id: 6252001
description:
2026-01-31 14:52:33 38223 [Warning] Aborted connection 38223 to db: 'unconnected' user: 'unauthenticated' host: '157.245.131.154' (This connection closed normally without authentication)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22c90a0d466ecb5da7ae0f1ed84b2d124ebdeb00||Title:0x64b83028||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:52:02 dovecot_login authenticator failed for H=(M9Qi3Rg) [141.98.11.48]:63008: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 14:53:20 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:33986: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.113.34
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=470762 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.101.62.172
country_id: 3469034
domain: astlog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:astlogc.astlog.com.my||ServerName:astlog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:973d58a1931bd01089a54e81543cbebecfd694fa||Title:0xaf15fd2f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:53:04 dovecot_login authenticator failed for H=(VYjhev) [158.94.209.22]:55941: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 14:53:12 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:55764: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2026-01-31 14:53:19 dovecot_login authenticator failed for H=([121.18.49.14]) [121.18.49.14]:37522: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:53:20 dovecot_login authenticator failed for H=(6bDRjufA8k) [141.98.11.48]:62489: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-31 14:53:34 dovecot_login authenticator failed for H=(syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:56445: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-31 14:53:38 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:34160: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:54:08 dovecot_login authenticator failed for H=(WqSLk4siJ) [158.94.209.22]:60926: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 14:54:11 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:39935: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:54:53 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:54:02 dovecot_login authenticator failed for H=(YlGc4pqh90) [141.98.11.48]:54347: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:55:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:55:13 dovecot_login authenticator failed for H=(Ot923nnF2) [158.94.209.22]:65084: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:55:17 dovecot_login authenticator failed for H=(KEHKY4g18J) [141.98.11.48]:49757: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:56:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:56:07 dovecot_login authenticator failed for H=(sadk9md7) [158.94.209.22]:52572: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:56:30 dovecot_login authenticator failed for H=(Q0vjOSz0) [141.98.11.48]:58641: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:56:25 dovecot_login authenticator failed for H=(vA4RN1Z) [158.94.209.22]:53823: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-31 14:57:37 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:41498: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.18.158
country_id: 2921044
description:
2026-01-31 14:57:11 dovecot_login authenticator failed for H=(ADMIN) [138.199.18.158]:23841: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:57:19 dovecot_login authenticator failed for H=(cJMSjG) [158.94.209.22]:57582: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-31 14:57:34 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:57629: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:57:08 dovecot_login authenticator failed for H=(CvrttuU) [141.98.11.48]:52693: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:57:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-31 14:57:43 dovecot_login authenticator failed for H=(nsg-corporate-203.184.185.122.airtel.in) [152.52.244.106]:56506: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-31 14:58:16 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:37082: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-31 14:58:23 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:58126: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:58:29 dovecot_login authenticator failed for H=(lMeQ2RDR0m) [141.98.11.48]:58886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:58:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:58:13 dovecot_login authenticator failed for H=(pw6bKD) [158.94.209.22]:61430: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 14:59:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-01-31 14:59:10 dovecot_login authenticator failed for H=([114.202.80.152]) [114.202.80.152]:38717: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-31 14:59:17 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:49420: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2026-01-31 14:59:35 dovecot_login authenticator failed for H=(78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:59150: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 14:59:07 dovecot_login authenticator failed for H=(VnCDpG) [141.98.11.48]:59531: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-31 14:59:58 dovecot_login authenticator failed for H=(nsg-static-193.132.71.182.airtel.in) [182.79.83.98]:56144: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 14:59:07 dovecot_login authenticator failed for H=(9VAyGToY) [158.94.209.22]:65219: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:00:19 dovecot_login authenticator failed for H=(eablUNP) [158.94.209.22]:54005: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:00:19 dovecot_login authenticator failed for H=(8Fnrq9aR) [141.98.11.48]:53526: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:00:37 dovecot_login authenticator failed for H=(1T7ilAis) [158.94.209.22]:55336: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:01:34 dovecot_login authenticator failed for H=(MZG2R4CLZK) [141.98.11.48]:52974: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:01:13 dovecot_login authenticator failed for H=(NIRhOgFIh) [158.94.209.22]:57894: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.150.208.150
country_id: 1694008
domain: chs.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87429.chs.com.my||ServerName:chs.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:db3360cec43c57eb38f4f050f6008a0b7d9324fa||Title:0xcec1af10||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.170.247
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/product.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:02:41 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.181.212
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wood/12/555/1281625 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:02:07 dovecot_login authenticator failed for H=(l4tNy9qn5) [158.94.209.22]:61620: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:02:11 dovecot_login authenticator failed for H=(e5KtER0pA) [141.98.11.48]:49651: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:03:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 15:03:38 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:48820: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:03:22 dovecot_login authenticator failed for H=(P8GEYL0LJq) [141.98.11.48]:50900: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:03:19 dovecot_login authenticator failed for H=(CfPmRGQ) [158.94.209.22]:50219: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.28.216
country_id: 2017370
description:
2026-01-31 15:03:46 dovecot_login authenticator failed for H=([91.227.28.216]) [91.227.28.216]:55815: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 15:03:56 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:46961: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:04:13 dovecot_login authenticator failed for H=(ykHHFXIKq) [158.94.209.22]:53923: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:04:31 dovecot_login authenticator failed for H=(Kcq9f8F) [158.94.209.22]:55151: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:04:35 dovecot_login authenticator failed for H=(BpFX7mjHm8) [141.98.11.48]:54569: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-01-31 15:04:48 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [14.96.29.14]:46894: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2026-01-31 15:04:58 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:33454: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:04:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.155.146
country_id: 1814991
description:
2026-01-31 15:05:03 dovecot_login authenticator failed for H=([58.56.155.146]) [58.56.155.146]:24206: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:05:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:05:07 dovecot_login authenticator failed for H=(0cX2DC0vj) [158.94.209.22]:57652: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:05:10 dovecot_login authenticator failed for H=(J1kgHY) [141.98.11.48]:61889: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:06:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:06:19 dovecot_login authenticator failed for H=(o8YL0nQU) [158.94.209.22]:62606: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:06:20 dovecot_login authenticator failed for H=(eU0Lw1) [141.98.11.48]:50668: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-31 15:06:53 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:49780: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: chs.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/chscommy/public_html/images/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:07:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 15:07:33 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:59943: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:07:13 dovecot_login authenticator failed for H=(fIWeGft) [158.94.209.22]:49838: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:07:31 dovecot_login authenticator failed for H=(cTSjJSV) [141.98.11.48]:55737: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 15:09:00 H=([45.144.212.50]) [45.144.212.50]:56545 F=<ccmsservice@bangkokbank.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:08:06 dovecot_login authenticator failed for H=(HUT21PWK) [141.98.11.48]:65381: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:08:08 dovecot_login authenticator failed for H=(IzFfS55awn) [158.94.209.22]:53505: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:08:44 dovecot_login authenticator failed for H=(1QOEcWLi9K) [158.94.209.22]:55926: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 15:08:23 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:38572: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:09:02 dovecot_login authenticator failed for H=(92GlXXvlo) [158.94.209.22]:57115: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.35.64
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing-details.php?id=84605649 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-31 15:09:07 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:34141: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:10:25 dovecot_login authenticator failed for H=(zjdBbZpP) [141.98.11.48]:64118: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:10:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:10:14 dovecot_login authenticator failed for H=(FCCbkAtOw) [158.94.209.22]:61866: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:11:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:11:08 dovecot_login authenticator failed for H=(V3OJcD74) [158.94.209.22]:65500: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 15:11:17 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36894: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 15:11:36 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:47352: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-31 15:11:55 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:40474: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 15:11:22 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:41852: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:11:37 dovecot_login authenticator failed for H=(xX37MfH) [141.98.11.48]:54544: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-31 15:11:45 dovecot_login authenticator failed for H=(nsg-corporate-222.230.187.122.airtel.in) [122.187.230.222]:36431: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:12:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2026-01-31 15:12:35 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:55944: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2026-01-31 15:12:36 dovecot_login authenticator failed for H=([149.54.51.162]) [149.54.51.162]:37769: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
country_id: 1814991
description:
2026-01-31 15:12:03 dovecot_login authenticator failed for H=([112.27.129.78]) [112.27.129.78]:53506: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 15:12:22 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:51578: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:12:56 dovecot_login authenticator failed for H=(FTKq1e) [158.94.209.22]:56223: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:12:02 dovecot_login authenticator failed for H=(Bb1AqVMlue) [158.94.209.22]:52658: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-01-31 15:12:38 dovecot_login authenticator failed for H=([61.97.17.208]) [61.97.17.208]:35187: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:12:02 dovecot_login authenticator failed for H=(3G2WbQG) [141.98.11.48]:59971: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2026-01-31 15:12:04 dovecot_login authenticator failed for H=([203.193.137.250]) [203.193.137.250]:49585: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.122
country_id: 1814991
description:
2026-01-31 15:12:09 dovecot_login authenticator failed for H=([27.24.141.122]) [27.24.141.122]:59234: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:13:14 dovecot_login authenticator failed for H=(SCbcwOZRrt) [158.94.209.22]:57392: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.56.155.146
country_id: 1814991
description:
2026-01-31 15:13:47 dovecot_login authenticator failed for H=([58.56.155.146]) [58.56.155.146]:61932: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:13:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:13:20 dovecot_login authenticator failed for H=(Rj4B9p) [141.98.11.48]:55499: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 15:13:48 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:43215: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:14:32 dovecot_login authenticator failed for H=(zzYMhW1zNX) [141.98.11.48]:56397: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 15:14:10 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:37652: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.166
country_id: 1269750
description:
2026-01-31 15:14:24 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-209.55.23.125.airtelbroadband.in) [182.95.182.166]:32814: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:14:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:14:08 dovecot_login authenticator failed for H=(YwaKy2Ve) [158.94.209.22]:60860: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:15:02 dovecot_login authenticator failed for H=(ZYmbOUvNuN) [158.94.209.22]:64358: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 15:15:13 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (cerfich) [87.103.126.54]:42072: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:15:24 dovecot_login authenticator failed for H=(ayDCkXQE) [158.94.208.175]:63069: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 15:15:45 dovecot_login authenticator failed for H=([187.7.85.97]) [201.15.149.254]:49490: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:15:05 dovecot_login authenticator failed for H=(bvR0WsPGRJ) [141.98.11.48]:59413: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-31 15:15:09 dovecot_plain authenticator failed for H=(breteeises) [65.20.129.28]:46300: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-01-31 15:15:27 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net [111.70.28.243]:43929: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-01-31 15:15:46 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:56812: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-31 15:16:28 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:56990: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2026-01-31 15:16:34 dovecot_login authenticator failed for H=([180.94.75.114]) [180.94.75.114]:60730: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-01-31 15:16:50 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:45492: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-31 15:16:55 dovecot_login authenticator failed for H=([122.184.127.86]) [122.184.127.86]:42654: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.46.173.51
country_id: 2510769
description:
2026-01-31 15:16:40 dovecot_login authenticator failed for H=51.red-83-46-173.dynamicip.rima-tde.net [83.46.173.51]:46884: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:16:23 dovecot_login authenticator failed for H=(DMGdENP) [158.94.208.175]:51743: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-01-31 15:16:24 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:56012: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.168.210.53
country_id: 6252001
description:
2026-01-31 15:16:10 dovecot_login authenticator failed for H=([166.168.210.53]) [166.168.210.53]:34092: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:16:12 dovecot_login authenticator failed for H=(xqp3byzAw) [141.98.11.48]:55417: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:16:14 dovecot_login authenticator failed for H=(lke2WqL0n) [158.94.209.22]:52724: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:17:08 dovecot_login authenticator failed for H=(RGbB2PQm74) [158.94.209.22]:56114: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:17:26 dovecot_login authenticator failed for H=(HSdIzgaY) [158.94.209.22]:57269: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:17:26 dovecot_login authenticator failed for H=(7KlkjX) [141.98.11.48]:60870: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.148.64
country_id: 1562822
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/new.html\" HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:17:18 dovecot_login authenticator failed for H=(5UFgyl) [158.94.208.175]:55770: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-31 15:18:53 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:46510: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 15:18:53 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:39930: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 15:18:10 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:59740: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:18:38 dovecot_login authenticator failed for H=(QV8PTS) [158.94.208.175]:55051: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:18:02 dovecot_login authenticator failed for H=(CNj94V) [141.98.11.48]:55707: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2026-01-31 15:18:17 dovecot_login authenticator failed for H=sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:58514: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:18:02 dovecot_login authenticator failed for H=(QUcdPKR) [158.94.209.22]:59587: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:18:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.106.59.245
country_id: 1835841
description:
2026-01-31 15:18:34 dovecot_login authenticator failed for H=([183.106.59.245]) [183.106.59.245]:45195: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 15:19:39 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:37355: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:19:06 dovecot_login authenticator failed for H=(wIZViCw9) [158.94.208.175]:56393: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:19:11 dovecot_login authenticator failed for H=(QVIbjxWB) [141.98.11.48]:63525: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:19:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:19:14 dovecot_login authenticator failed for H=(jpTII1U12) [158.94.209.22]:64117: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 15:19:25 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:60536: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.156.185.211
country_id: 3439705
domain: webhosting2u.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/webhosting2u.com/masaaki/products/em-pb-2/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:20:02 dovecot_login authenticator failed for H=(siTyN5) [158.94.208.175]:50215: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.237.46.128
country_id: 1814991
description:
2026-01-31 15:20:57 dovecot_login authenticator failed for H=([116.237.46.128]) [116.237.46.128]:55791: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:20:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:20:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:20:08 dovecot_login authenticator failed for H=(ZHbxog) [158.94.209.22]:51173: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:20:14 dovecot_login authenticator failed for H=(UXgaiVByz8) [141.98.11.48]:63972: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.49.26
country_id: 226074
description:
2026-01-31 15:20:29 dovecot_login authenticator failed for H=([196.0.49.26]) [196.0.49.26]:55445: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:21:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:21:09 dovecot_login authenticator failed for H=(XIFpQmG) [141.98.11.48]:52226: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:21:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.80.127
country_id: 1269750
description:
2026-01-31 15:21:21 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [49.36.80.127]:41504: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:21:20 dovecot_login authenticator failed for H=(GJ8UY1R26) [158.94.209.22]:55793: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: nexuscollection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/nexus2019/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:21:26 dovecot_login authenticator failed for H=(okIjtc) [158.94.208.175]:52503: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.232.161.15
country_id: 1814991
description:
2026-01-31 15:21:31 dovecot_login authenticator failed for H=([116.232.161.15]) [116.232.161.15]:32261: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.24.139
country_id: 6252001
domain: 34.221.200.0
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.221.200.0/azenv3.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-01-31 15:21:47 dovecot_login authenticator failed for H=([203.252.10.4]) [203.252.10.4]:12981: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:21:02 dovecot_login authenticator failed for H=(GEtUErF) [158.94.209.22]:54660: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-31 15:22:02 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:36827: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:22:14 dovecot_login authenticator failed for H=(qgLgBhFEQm) [158.94.209.22]:59243: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:22:21 dovecot_login authenticator failed for H=(gQhsXe1v) [158.94.208.175]:57355: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:22:25 dovecot_login authenticator failed for H=(lIl1lc) [141.98.11.48]:51958: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2026-01-31 15:22:56 dovecot_login authenticator failed for H=([121.134.31.193]) [121.134.31.193]:42978: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-31 15:22:57 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:51128: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:22:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:22:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.53
country_id: 1668284
description:
2026-01-31 15:22:30 dovecot_login authenticator failed for H=111-70-32-53.emome-ip.hinet.net [111.70.32.53]:41210: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.222.235.40
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hate/16/303/1603251 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:23:08 dovecot_login authenticator failed for H=(vYSpoCR) [158.94.209.22]:62771: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:23:14 dovecot_login authenticator failed for H=(7zqx1QE) [158.94.208.175]:59713: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-01-31 15:23:46 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:57272: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.86
country_id: 6252001
description:
2026-01-31 15:23:24 dovecot_login authenticator failed for H=([63.65.203.86]) [63.65.203.86]:58674: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 74.248.24.163
country_id: 798544
domain: autogreastar.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/autogrea/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 106.219.87.217
country_id: 1269750
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/rpm/rpm.log||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:23:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 158.94.208.175


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.163
country_id: 798544
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/admin/upload/css.php||SC:/home/autogrea/public_html/admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2026-01-31 15:23:19 dovecot_login authenticator failed for H=([118.45.101.159]) [118.45.101.159]:40649: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:23:26 dovecot_login authenticator failed for H=(NLUEMKO) [141.98.11.48]:60925: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.163
country_id: 798544
domain: autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/about.php||SC:/home/autogrea/public_html/images/about.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.237.42.203
country_id: 130758
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ruler/16/536/1671288 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:24:02 dovecot_login authenticator failed for H=(SOty1fTTo) [158.94.209.22]:49827: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:24:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alanlai has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:24:10 dovecot_login authenticator failed for H=(1bCl55r39q) [158.94.208.175]:60993: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.176.76.222
country_id: 2542007
description:
2026-01-31 15:24:35 dovecot_plain authenticator failed for H=([192.168.1.9]) [160.176.76.222]:59272: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 15:24:05 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:1788: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.27
country_id: 3996063
description:
2026-01-31 15:25:00 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.27]:3023: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:24:03 dovecot_login authenticator failed for H=(Rcn2CO) [141.98.11.48]:52543: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-01-31 15:25:39 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:53094: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:25:06 dovecot_login authenticator failed for H=(YhObilcj) [158.94.208.175]:60614: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:25:17 dovecot_login authenticator failed for H=(RiXfBEp) [141.98.11.48]:61300: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-31 15:25:33 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:34242: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:25:14 dovecot_login authenticator failed for H=(eeBanUUMTc) [158.94.209.22]:54511: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:25:32 dovecot_login authenticator failed for H=(bkJiXy) [158.94.209.22]:55694: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 15:25:53 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:43638: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 15:25:26 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:56457: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 15:25:48 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1144: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.122.255.215
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/02types-xls.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:26:08 dovecot_login authenticator failed for H=(shoHEfO) [158.94.209.22]:57986: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:26:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:26:02 dovecot_login authenticator failed for H=(1xXeTPxkM) [158.94.208.175]:55273: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:26:26 dovecot_login authenticator failed for H=(HcG3vFtArO) [141.98.11.48]:54256: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 15:26:46 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:39480: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 15:26:55 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:43526: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.27
country_id: 3996063
description:
2026-01-31 15:27:50 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.27]:65373: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.107.0.188
country_id: 1814991
description:
2026-01-31 15:27:55 dovecot_login authenticator failed for H=([218.107.0.188]) [218.107.0.188]:58277: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:27:02 dovecot_login authenticator failed for H=(Fz5J4YuR) [158.94.209.22]:61434: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:27:14 dovecot_login authenticator failed for H=(OMUVc7xeZ) [141.98.11.48]:62533: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:27:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:27:26 dovecot_login authenticator failed for H=(amPL8T2gn) [158.94.208.175]:64478: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.90.46
country_id: 3923057
description:
2026-01-31 15:28:05 dovecot_login authenticator failed for H=host-181-114-90-46.supernet.com.bo (static-200-58-83-79.supernet.com.bo) [181.114.90.46]:52234: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:28:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:28:14 dovecot_login authenticator failed for H=(umqTJF) [158.94.209.22]:49710: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2026-01-31 15:28:25 dovecot_login authenticator failed for H=111-70-29-158.emome-ip.hinet.net [111.70.29.158]:45524: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 15:28:41 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:53882: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
country_id: 1814991
description:
2026-01-31 15:28:08 dovecot_login authenticator failed for H=([180.142.105.18]) [180.142.105.18]:47001: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:28:20 dovecot_login authenticator failed for H=(5BsHcRJrWE) [158.94.208.175]:63878: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2026-01-31 15:28:33 dovecot_login authenticator failed for H=(st7oJf) [141.98.11.48]:61046: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2026-01-31 15:29:00 dovecot_login authenticator failed for H=([220.93.167.144]) [220.93.167.144]:36036: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:29:15 dovecot_login authenticator failed for H=(265eRiK) [158.94.208.175]:61839: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:29:44 dovecot_login authenticator failed for H=(QA2sYY5UrQ) [158.94.209.22]:55399: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:29:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 15:29:11 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:60462: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-31 15:29:41 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:57016: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-01-31 15:29:19 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:49531: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-31 15:29:58 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:33786: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:29:08 dovecot_login authenticator failed for H=(ONpfOxj19T) [158.94.209.22]:53165: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.55.188.121
country_id: 2029969
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/cart.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 15:29:45 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:60422: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 15:29:02 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:32890: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 15:30:05 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:14845: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-31 15:30:19 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:54426: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.230.241.152
country_id: 1814991
description:
2026-01-31 15:30:48 dovecot_login authenticator failed for H=([122.230.241.152]) [122.230.241.152]:38464: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:30:02 dovecot_login authenticator failed for H=(kugilK) [158.94.209.22]:56516: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:30:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:30:09 dovecot_login authenticator failed for H=(ZBUsk0cQd) [158.94.208.175]:56060: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.237.90
country_id: 1814991
description:
2026-01-31 15:30:56 dovecot_login authenticator failed for H=([221.228.237.90]) [221.228.237.90]:48242: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-31 15:30:21 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:35358: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2026-01-31 15:31:10 dovecot_login authenticator failed for H=([218.22.187.69]) [218.22.187.66]:34635: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:31:14 dovecot_login authenticator failed for H=(mymj86dv3j) [158.94.209.22]:61017: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 15:31:16 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:51454: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.6.162
country_id: 1668284
description:
2026-01-31 15:31:23 dovecot_login authenticator failed for H=([192.72.6.162]) [192.72.6.162]:45931: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 15:31:05 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:43142: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 15:31:42 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:45413: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 15:31:44 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:46232: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-31 15:32:00 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:59801: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:31:05 dovecot_login authenticator failed for H=(VqaFLCW) [158.94.208.175]:50637: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2026-01-31 15:31:08 dovecot_login authenticator failed for H=([92.126.223.175]) [92.126.223.175]:50324: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-31 15:31:55 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:35906: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-31 15:32:06 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:59355: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2026-01-31 15:32:31 dovecot_login authenticator failed for H=([178.178.222.56]) [178.178.222.56]:52504: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.99.5.31
country_id: 2017370
description:
2026-01-31 15:32:35 dovecot_login authenticator failed for H=([176.99.5.31]) [176.99.5.31]:47740: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-31 15:32:28 dovecot_login authenticator failed for H=(nsg-corporate-41.139.185.122.airtel.in) [182.95.184.130]:49424: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:32:08 dovecot_login authenticator failed for H=(ZsQWSex) [158.94.208.175]:50247: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-31 15:32:58 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:53893: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:32:08 dovecot_login authenticator failed for H=(2O0PBDQt) [158.94.209.22]:64391: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-01-31 15:32:48 dovecot_login authenticator failed for H=(c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:51638: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-31 15:33:56 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:40804: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:33:02 dovecot_login authenticator failed for H=(GlkQKf) [158.94.209.22]:51359: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-31 15:33:12 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:40301: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:33:13 dovecot_login authenticator failed for H=(YHsMpkhp) [158.94.208.175]:61639: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:33:54 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:33:56 dovecot_login authenticator failed for H=(DVcXtS) [158.94.209.22]:54634: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-31 15:34:00 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:58014: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 15:34:47 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:35796: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 15:34:53 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:39780: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:34:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:34:17 dovecot_login authenticator failed for H=(xuD7vtmU) [158.94.208.175]:63716: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-31 15:34:41 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:33388: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-31 15:34:52 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:58284: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:34:14 dovecot_login authenticator failed for H=(CFtEfsp) [158.94.209.22]:55759: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-31 15:34:14 dovecot_login authenticator failed for H=([175.180.129.87]) [175.180.129.87]:33872: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.124
country_id: 6252001
description:
2026-01-31 15:34:49 39735 [Warning] Aborted connection 39735 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.124' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:35:01 dovecot_login authenticator failed for H=(dPJNuQldh) [158.94.208.175]:60095: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:35:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:35:08 dovecot_login authenticator failed for H=(1zMLjFa) [158.94.209.22]:59088: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.242.99
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88641515551094 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 15:36:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account shamini.velayuthan@cofreth.com.my has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:36:05 dovecot_login authenticator failed for H=(KviljZ) [158.94.208.175]:58507: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.15.116
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=365736 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 15:36:02 dovecot_login authenticator failed for H=(cAmj95Iqle) [158.94.209.22]:62357: 535 Incorrect authentication data (set_id=shamini.velayuthan@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.187.43
country_id: 2017370
description:
2026-01-31 15:37:53 dovecot_plain authenticator failed for H=(perfoeci) [85.236.187.43]:45802: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/mkmetalc/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 15:37:13 dovecot_login authenticator failed for H=(2NX9k3kJ) [69.5.189.21]:58465: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:37:13 dovecot_login authenticator failed for H=(enWA18) [158.94.208.175]:55673: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:39:00 dovecot_login authenticator failed for H=(z23z8yW) [158.94.208.175]:57408: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:38:16 dovecot_login authenticator failed for H=(EBK4p952M) [158.94.208.175]:50787: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 15:38:28 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:57016: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 15:38:01 dovecot_login authenticator failed for H=(EzopSLKtV) [69.5.189.21]:49765: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.100.250.41
country_id: 2017370
description:
2026-01-31 15:39:48 dovecot_login authenticator failed for H=(93.100.250.41.pool.sknt.ru) [93.100.250.41]:60558: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 15:39:10 dovecot_login authenticator failed for H=(yHXDEW7tR) [69.5.189.21]:61076: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.186.183.88
country_id: 2017370
description:
2026-01-31 15:39:57 dovecot_login authenticator failed for H=(188x186x183x88.dynamic.tmn.ertelecom.ru) [188.186.183.88]:50774: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:39:27 dovecot_login authenticator failed for H=(i3YlDoAdg) [158.94.208.175]:52533: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:40:14 dovecot_login authenticator failed for H=(Abx7086NFe) [158.94.208.175]:54367: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 15:40:22 dovecot_login authenticator failed for H=(GoP5jq4p6) [69.5.189.21]:56437: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.188.229.171
country_id: 3996063
description:
2026-01-31 15:41:57 dovecot_plain authenticator failed for H=fixed-187-188-229-171.totalplay.net (6S73LVD8) [187.188.229.171]:15897: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 120.29.78.1
country_id: 1694008
domain: cordage.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:39169.cordage.com.my||ServerName:cordage.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d2e87493746a752784a3f33aeeebde70338a64a0||Title:0xd984466b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 15:41:07 dovecot_login authenticator failed for H=(zcx31Mrl9L) [69.5.189.21]:51921: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-01-31 15:41:11 dovecot_plain authenticator failed for H=(supermurs) [192.159.99.193]:38462: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:41:16 dovecot_login authenticator failed for H=(GvfyIiusv) [158.94.208.175]:58336: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.17.213.162
country_id: 1814991
description:
2026-01-31 15:42:12 dovecot_login authenticator failed for H=([111.17.213.162]) [111.17.213.162]:60791: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.175.11
country_id: 2017370
description:
2026-01-31 15:42:29 dovecot_login authenticator failed for H=(5x167x175x11.dynamic.kirov.ertelecom.ru) [5.167.175.11]:53740: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 15:42:40 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:37058: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 15:42:57 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:41526: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.188.229.171
country_id: 3996063
description:
2026-01-31 15:42:05 dovecot_login authenticator failed for H=fixed-187-188-229-171.totalplay.net (6S73LVD8) [187.188.229.171]:15897: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:42:16 dovecot_login authenticator failed for H=(8l6sTC6kq) [158.94.208.175]:58820: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.135.30
country_id: 3469034
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=744397 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 15:42:19 dovecot_login authenticator failed for H=(uQsiqeEQPW) [69.5.189.21]:53047: 535 Incorrect authentication data (set_id=kasim_kn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-01-31 15:42:55 dovecot_login authenticator failed for H=(static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:54746: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.204.119.170
country_id: 290557
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/capability.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 116.251.216.100
country_id: 1880251
domain: figofoods.com.my
description:
IM360 WAF: Special shell symbol in request||MV:@var_dump(md5(482578328)||MVN:ARGS:id||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:43:19 dovecot_login authenticator failed for H=(4OgjnHp) [158.94.208.175]:64549: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:44:00 dovecot_login authenticator failed for H=(f94ZRuY) [158.94.208.175]:61097: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
country_id: 2017370
description:
2026-01-31 15:43:03 dovecot_login authenticator failed for H=([178.178.194.137]) [178.178.194.137]:33444: 535 Incorrect authentication data (set_id=amir)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 116.251.216.100
country_id: 1880251
domain: figofoods.com.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home2/cabecom/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 116.251.216.100
country_id: 1880251
domain: figofoods.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:'-var_dump(md5(984717081))-'||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:44:16 dovecot_login authenticator failed for H=(oBdryxuF) [158.94.208.175]:52241: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:45:22 dovecot_login authenticator failed for H=(cImSKaVI) [158.94.208.175]:63595: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:46:03 dovecot_login authenticator failed for H=(tCwy54hWxh) [158.94.208.175]:63176: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.137.151.93
country_id: 1814991
description:
2026-01-31 15:46:22 dovecot_login authenticator failed for H=([180.137.151.93]) [180.137.151.93]:44258: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2026-01-31 15:46:47 dovecot_login authenticator failed for H=(syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:46799: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-01-31 15:46:53 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [92.62.74.41]:57697: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:47:50 dovecot_login authenticator failed for H=(CUD4n11A) [158.94.208.175]:55090: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.134
country_id: 2017370
description:
2026-01-31 15:47:13 dovecot_login authenticator failed for H=([178.178.194.134]) [178.178.194.134]:33514: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:47:23 dovecot_login authenticator failed for H=(Ir4yF6pef2) [158.94.208.175]:64898: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 15:48:35 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1201: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-31 15:48:48 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:57369: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.232.252.106
country_id: 1814991
description:
2026-01-31 15:48:58 dovecot_login authenticator failed for H=([112.232.252.106]) [112.232.252.106]:46412: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.44.185.163
country_id: 1694008
description:
2026-01-31 15:48:19 dovecot_plain authenticator failed for H=(Q171B58071) [143.44.185.163]:15851: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:48:08 dovecot_login authenticator failed for H=(r43fikn3) [158.94.208.175]:50200: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2026-01-31 15:48:30 dovecot_login authenticator failed for H=([50.123.92.130]) [50.123.92.130]:53633: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.101.182
country_id: 3469034
description:
2026-01-31 15:48:41 dovecot_login authenticator failed for H=(182.101.95.187.dynamic.liggatelecom.com.br) [187.95.101.182]:39376: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:49:02 dovecot_login authenticator failed for H=(IlqVFQJExD) [158.94.208.175]:57482: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-01-31 15:49:08 dovecot_login authenticator failed for H=([101.13.4.120]) [101.13.4.120]:44490: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.129.2
country_id: 1814991
description:
2026-01-31 15:49:10 dovecot_login authenticator failed for H=(3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:39543: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/products.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 15:50:48 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:34852: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:50:02 dovecot_login authenticator failed for H=(sFnfSL) [158.94.208.175]:58616: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-31 15:50:10 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:56778: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 15:50:19 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:38940: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 15:50:28 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:56167: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 15:51:44 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:60306: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:51:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:51:24 dovecot_login authenticator failed for H=(XPaoyXpUn) [158.94.208.175]:59108: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:51:35 dovecot_login authenticator failed for H=(e1BRWxj) [158.94.208.175]:62496: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2026-01-31 15:51:36 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [109.195.29.57]:53258: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.15
country_id: 1821275
description:
2026-01-31 15:51:57 dovecot_login authenticator failed for H=(ADMIN) [84.252.92.15]:1203: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:52:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2026-01-31 15:52:14 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:56473: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:52:14 dovecot_login authenticator failed for H=(SA1YKLDVc) [158.94.208.175]:62599: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.242
country_id: 1814991
description:
2026-01-31 15:52:14 dovecot_login authenticator failed for H=([111.61.176.242]) [111.61.176.242]:31056: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2026-01-31 15:52:40 dovecot_login authenticator failed for H=([182.79.126.100]) [182.95.57.194]:46298: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2026-01-31 15:52:02 dovecot_login authenticator failed for H=(2-74-194-86.kcell.kz) [2.74.194.86]:49508: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:53:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:53:15 dovecot_login authenticator failed for H=(iqihRE4esh) [158.94.208.175]:52764: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.63.162
country_id: 99237
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/products HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-01-31 15:53:02 dovecot_login authenticator failed for H=([27.123.119.254]) [128.185.246.106]:59754: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:54:12 dovecot_login authenticator failed for H=(YKHbhe) [158.94.208.175]:55005: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.253.242.105
country_id: 1643084
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/desk/13/226/1332654 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-01-31 15:54:30 dovecot_login authenticator failed for H=([182.78.87.2]) [182.78.87.2]:60744: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:54:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account bentey has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.159.174.17
country_id: 1835841
description:
2026-01-31 15:54:42 dovecot_login authenticator failed for H=([221.159.174.17]) [221.159.174.17]:45730: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:55:24 dovecot_login authenticator failed for H=(Nqz1tziV) [158.94.208.175]:50903: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 15:55:53 dovecot_login authenticator failed for H=(2F8rT7k) [158.94.208.215]:51902: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.60.211.114
country_id: 6252001
description:
2026-01-31 15:55:17 dovecot_login authenticator failed for H=67-60-211-114.cpe.sparklight.net [67.60.211.114]:59716: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 78.153.140.224
country_id: 2635167
domain: 42.0.28.25
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/config.ini||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 15:55:59 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:52323: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: eminent.st
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/eminent/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:55:37 dovecot_login authenticator failed for H=(XWVQhNvc) [158.94.208.175]:62359: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:56:17 dovecot_login authenticator failed for H=(SARy71Fl) [158.94.208.175]:51864: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 15:56:17 dovecot_login authenticator failed for H=(hvFQPdV) [158.94.208.215]:52608: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2026-01-31 15:56:34 dovecot_login authenticator failed for H=(host253.181-93-60.telecom.net.ar) [181.93.60.253]:58984: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2026-01-31 15:56:15 dovecot_login authenticator failed for H=([203.193.147.75]) [203.193.147.75]:56218: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-31 15:56:47 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:35736: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:56:55 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.162.117
country_id: 2017370
description:
2026-01-31 15:56:58 dovecot_login authenticator failed for H=broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:43092: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 15:56:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 15:57:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-31 15:57:08 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:24988: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2026-01-31 15:57:13 dovecot_login authenticator failed for H=([49.124.151.57]) [49.124.151.57]:39496: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2026-01-31 15:58:00 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:42492: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 15:57:29 dovecot_login authenticator failed for H=(IPFXgSA) [158.94.208.215]:61562: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:57:16 dovecot_login authenticator failed for H=(fAKVPmQ0lK) [158.94.208.175]:56115: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 36.37.203.28
country_id: 1831722
description:
Jan 31 15:57:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(36.37.203.28)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 15:57:05 dovecot_login authenticator failed for H=(h3ZUq7Jc) [158.94.208.215]:62438: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
country_id: 1814991
description:
2026-01-31 15:58:06 dovecot_login authenticator failed for H=([222.185.255.229]) [222.185.255.227]:36261: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 15:58:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:58:14 dovecot_login authenticator failed for H=(qAOB8E734) [158.94.208.175]:59451: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 15:58:17 dovecot_login authenticator failed for H=(wiBjf8p) [158.94.208.215]:60593: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-31 15:58:16 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:36750: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 15:58:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 15:59:13 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:41912: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 15:59:29 dovecot_login authenticator failed for H=(PwPMAuz) [158.94.208.215]:51673: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-01-31 15:59:31 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:33475: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 15:59:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 15:59:05 dovecot_login authenticator failed for H=(RSAo3kE) [158.94.208.215]:58307: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 15:59:20 dovecot_login authenticator failed for H=(Xi2lv5) [158.94.208.175]:58108: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-31 15:59:49 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:53956: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 15:59:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 15:59:25 dovecot_login authenticator failed for H=(LRuRJp) [185.91.69.136]:63162: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:00:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:00:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:00:17 dovecot_login authenticator failed for H=(t4Jlnza) [158.94.208.215]:55567: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-01-31 16:00:32 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:36466: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.138
country_id: 1269750
description:
2026-01-31 16:00:46 dovecot_login authenticator failed for H=([125.23.183.138]) [125.23.183.138]:56206: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-31 16:00:50 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:50132: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.91.69.136
country_id: 2635167
description:
Jan 31 16:00:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(185.91.69.136)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-31 16:00:59 dovecot_login authenticator failed for H=(nsg-static-193.132.71.182.airtel.in) [182.79.83.98]:33000: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-01-31 16:00:43 dovecot_login authenticator failed for H=(nsg-corporate-151.229.187.122.airtel.in) [122.187.229.151]:43082: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:00:16 dovecot_login authenticator failed for H=(X5ooydEYs) [158.94.208.175]:58289: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-31 16:00:38 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:44962: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:00:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 16:00:15 dovecot_login authenticator failed for H=(UfZuJC) [185.91.69.136]:52775: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 16:00:47 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:47170: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.60.41.239
country_id: 2510769
description:
2026-01-31 16:00:41 dovecot_login authenticator failed for H=239.red-83-60-41.dynamicip.rima-tde.net [83.60.41.239]:60309: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:01:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:01:09 dovecot_login authenticator failed for H=(95bqcFMqXT) [158.94.208.175]:62110: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 16:01:20 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:40948: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:01:05 dovecot_login authenticator failed for H=(p8NOZfra) [158.94.208.215]:64947: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:01:07 dovecot_login authenticator failed for H=(RnelNjRfq) [77.90.185.50]:63938: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 16:01:45 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:35766: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/4||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.134.17.245
country_id: 2328926
domain: astlog.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:102.134.17.245||TA:102.134.17.245||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:01:05 dovecot_login authenticator failed for H=(L9BL8TY) [158.94.208.215]:64944: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-31 16:01:13 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:44948: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 16:01:15 dovecot_login authenticator failed for H=(fW4J2u) [185.91.69.136]:58119: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2026-01-31 16:02:02 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:39988: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:02:10 dovecot_login authenticator failed for H=(pUIGI6fb3l) [77.90.185.50]:50711: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:02:17 dovecot_login authenticator failed for H=(ev5zXU) [158.94.208.215]:53923: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.170.246
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/slick/slick.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.41
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/sweetalert/sweetalert.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.170.63
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.73.41
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/jquery/jquery.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.26
country_id: 1269750
description:
2026-01-31 16:02:58 dovecot_login authenticator failed for H=(nsg-corporate-247.223.187.122.airtel.in) [122.186.202.26]:46302: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.171.42
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/wow/wow.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 16:02:23 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:37874: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.138
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/waypoints/jquery.waypoints.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:02:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.129
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/select2/select2.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.170.226
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 16:02:09 dovecot_login authenticator failed for H=(g8EGZqL) [185.91.69.136]:64574: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.169.134
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/animsition/animsition.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/6||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.3
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/revolution/js/extensions/revolution.extension.layeranimation.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.170.78
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/isotope/isotope.pkgd.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:02:02 dovecot_login authenticator failed for H=(rCpya2w0YS) [77.90.185.50]:64791: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:02:18 dovecot_login authenticator failed for H=(7MdjszVvQ) [158.94.208.175]:62317: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.72
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/matchHeight/jquery.matchHeight-min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.105
country_id: 2635167
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/isotope/imagesloaded.pkgd.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:03:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:03:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:03:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 16:03:30 dovecot_login authenticator failed for H=(yFShWbH) [185.91.69.136]:61200: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.207.91.132
country_id: 1269750
description:
2026-01-31 16:03:35 dovecot_plain authenticator failed for H=(PMAJ2FF461FCD) [117.207.91.132]:64499: 535 Incorrect authentication data (set_id=mkchong@tst-ma.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:03:48 dovecot_login authenticator failed for H=(c02ZZ29L) [77.90.185.50]:62788: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.1.167.51
country_id: 1835841
description:
2026-01-31 16:03:41 dovecot_login authenticator failed for H=([49.1.167.51]) [49.1.167.51]:19703: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:03:05 dovecot_login authenticator failed for H=(kvDO0xJh) [158.94.208.175]:52662: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:03:05 dovecot_login authenticator failed for H=(FwPLwi) [158.94.208.215]:56384: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 16:03:15 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:25957: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:03:15 dovecot_login authenticator failed for H=(lhBxzAi6o) [77.90.185.50]:54699: 535 Incorrect authentication data (set_id=info@wcc.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:04:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/8||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-31 16:04:52 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:46726: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-31 16:04:04 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:50395: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 16:04:36 dovecot_login authenticator failed for H=(bkOjswp) [185.91.69.136]:53956: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:04:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:04:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:04:17 dovecot_login authenticator failed for H=(OgqBfX8uq) [158.94.208.215]:53961: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.91.69.136
country_id: 2635167
description:
Jan 31 16:04:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(185.91.69.136)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:04:01 dovecot_login authenticator failed for H=(rgclVjR) [77.90.185.50]:64983: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:04:13 dovecot_login authenticator failed for H=(3fH1ma) [158.94.208.175]:50500: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:04:19 dovecot_login authenticator failed for H=(G5YWIyqS) [77.90.185.50]:59001: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 149.50.97.212
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Web Downloader/6.9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:05:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 16:05:31 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:17990: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 16:05:35 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:58174: 535 Incorrect authentication data (set_id=admin@manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:05:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:05:12 dovecot_login authenticator failed for H=(GoClVhi) [158.94.208.175]:49398: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 58.49.113.138
country_id: 1814991
description:
Jan 31 16:05:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(58.49.113.138)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 16:05:36 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:38418: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:05:05 dovecot_login authenticator failed for H=(9KPz9KRL) [158.94.208.215]:61110: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 16:05:21 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:58465: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/11||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:05:17 dovecot_login authenticator failed for H=(GEvkgAnPy2) [77.90.185.50]:61495: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 149.50.97.212
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Microsoft URL Control - 6.00.8862||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 1.212.225.99
country_id: 1835841
description:
Jan 31 16:05:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(1.212.225.99)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:05:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:05:03 dovecot_login authenticator failed for H=(LZ0qeMB) [77.90.185.50]:55794: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:06:17 dovecot_login authenticator failed for H=(KkMUVsKaD) [158.94.208.215]:61434: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:06:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:06:32 dovecot_login authenticator failed for H=(hqDguzi) [158.94.208.175]:55605: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.91.69.136
country_id: 2635167
description:
2026-01-31 16:06:11 dovecot_login authenticator failed for H=(wvNQVcqSA) [185.91.69.136]:65268: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.179.38.132
country_id: 2017370
description:
2026-01-31 16:06:41 dovecot_plain authenticator failed for H=(reduc) [82.179.38.132]:45327: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/13||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.91.69.136
country_id: 2635167
description:
Jan 31 16:06:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(185.91.69.136)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:06:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 16:06:22 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:40779: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.4.22
country_id: 2017370
description:
2026-01-31 16:07:45 dovecot_login authenticator failed for H=([31.173.4.22]) [31.173.4.22]:36492: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:07:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:07:05 dovecot_login authenticator failed for H=(sxO5SaDL) [158.94.208.215]:50687: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-01-31 16:07:24 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:33658: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.209.55
country_id: 1835841
description:
2026-01-31 16:07:30 dovecot_login authenticator failed for H=([112.164.209.55]) [112.164.209.55]:53049: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:07:05 dovecot_login authenticator failed for H=(0dFXcV4fJ) [158.94.208.215]:50686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-31 16:07:10 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:39884: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/19||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:07:17 dovecot_login authenticator failed for H=(1CeLjJ) [158.94.208.175]:57145: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:07:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 16:08:24 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:57580: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:08:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.115.152
country_id: 1269750
description:
2026-01-31 16:08:56 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.115.152]:50199: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/25||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:08:13 dovecot_login authenticator failed for H=(NoKvsV1md) [158.94.208.175]:54732: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:08:17 dovecot_login authenticator failed for H=(vp0G6WNNg4) [158.94.208.215]:56310: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:09:26 dovecot_login authenticator failed for H=(BA9rEv4) [158.94.208.175]:55314: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2026-01-31 16:09:33 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:53188: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-31 16:09:50 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [98.122.215.23]:42196: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-31 16:10:00 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:41738: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:09:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:09:05 dovecot_login authenticator failed for H=(rFRD6np) [158.94.208.215]:51453: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-01-31 16:09:50 dovecot_login authenticator failed for H=([101.13.5.34]) [101.13.5.34]:52882: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/33||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-31 16:09:04 dovecot_login authenticator failed for H=([125.23.79.65]) [122.185.146.166]:39902: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:09:05 dovecot_login authenticator failed for H=(MiWGm3) [158.94.208.215]:51462: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.7.42.225
country_id: 2017370
description:
2026-01-31 16:10:17 dovecot_login authenticator failed for H=([185.7.42.225]) [185.7.42.225]:37738: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/41||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.210
country_id: 6252001
description:
2026-01-31 16:10:09 41378 [Warning] Aborted connection 41378 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.210' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:10:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:10:17 dovecot_login authenticator failed for H=(59BBXEQhX) [158.94.208.215]:53253: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.124.146
country_id: 1835841
description:
2026-01-31 16:10:18 dovecot_login authenticator failed for H=([121.66.124.146]) [121.66.124.146]:44466: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:10:41 dovecot_login authenticator failed for H=(yszVycV) [158.94.208.215]:53615: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.241.176.155
country_id: 298795
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/products/media-facade/outdoor-led-screen-e24-series/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:10:03 dovecot_login authenticator failed for H=(x79dOr) [158.94.208.175]:61556: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2026-01-31 16:10:10 dovecot_login authenticator failed for H=(nsg-corporate-255.223.187.122.airtel.in) [182.79.52.114]:49258: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: shop.pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/pftfood/public_html/epft/upload/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-31 16:10:38 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:58837: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-01-31 16:11:17 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:44052: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:11:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:11:03 dovecot_login authenticator failed for H=(01JeWN) [158.94.208.175]:50862: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:11:05 dovecot_login authenticator failed for H=(QnkBKQF) [158.94.208.215]:53314: 535 Incorrect authentication data (set_id=hock)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:11:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/48||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:12:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.102.115.142
country_id: 6252001
domain: mail.ahfengineering.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users/56||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-01-31 16:12:13 dovecot_login authenticator failed for H=([218.149.235.152]) [218.149.235.152]:53606: 535 Incorrect authentication data


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:12:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:12:41 dovecot_login authenticator failed for H=(Yg7eyGqH) [158.94.208.215]:55186: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:12:09 dovecot_login authenticator failed for H=(NHjqufU) [158.94.208.175]:51838: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:12:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 16:12:25 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:47980: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:12:17 dovecot_login authenticator failed for H=(9eSEo0hZx) [158.94.208.215]:60155: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:12:55 dovecot_login authenticator failed for H=(omGfnhXUZP) [77.90.185.50]:59195: 535 Incorrect authentication data (set_id=info@mams1.manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:13:03 dovecot_login authenticator failed for H=(6gI2Fkla) [77.90.185.50]:60476: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:13:05 dovecot_login authenticator failed for H=(qvsHR8) [158.94.208.215]:49422: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:13:42 dovecot_login authenticator failed for H=(RKWRPUF) [158.94.208.175]:64825: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:13:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:13:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-31 16:13:47 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:39942: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-01-31 16:13:30 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:32874: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-31 16:13:58 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:36334: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:13:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:14:17 dovecot_login authenticator failed for H=(4eagmmaG) [158.94.208.215]:49456: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:14:06 dovecot_login authenticator failed for H=(usVwBr) [178.16.54.22]:63726: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:14:06 dovecot_login authenticator failed for H=(e2lUSkt) [77.90.185.50]:63742: 535 Incorrect authentication data (set_id=info@uumism.edu.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:14:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 16:14:45 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:38300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:14:06 dovecot_login authenticator failed for H=(S2RihzLKDG) [158.94.208.175]:65087: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 187.8.120.90
country_id: 3469034
description:
Jan 31 16:14:43 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(187.8.120.90)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.26.113
country_id: 1522867
description:
2026-01-31 16:14:47 dovecot_login authenticator failed for H=2.135.26.113.dynamic.telecom.kz [2.135.26.113]:44695: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:14:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 16:14:35 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:53480: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:14:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:14:18 dovecot_login authenticator failed for H=(jYAg28L9ZF) [77.90.185.50]:52362: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2026-01-31 16:15:41 dovecot_login authenticator failed for H=([218.146.255.221]) [218.146.255.221]:61699: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:15:44 H=([167.148.167.71]) [167.148.167.71]:52278 F=<Support@hmz.com.my> rejected RCPT <account@hmz.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:15:02 dovecot_login authenticator failed for H=(XOz1QxjA) [77.90.185.50]:64885: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-01-31 16:15:09 dovecot_login authenticator failed for H=([125.19.196.207]) [27.123.104.142]:52634: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:15:35 dovecot_login authenticator failed for H=(QYI5UymeD) [178.16.54.22]:63520: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.164
country_id: 1269750
description:
2026-01-31 16:15:24 dovecot_login authenticator failed for H=([182.79.218.164]) [182.79.218.164]:51145: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.255.62.185
country_id: 2395170
description:
2026-01-31 16:15:40 dovecot_plain authenticator failed for H=(PMAJ2FF461FCD) [137.255.62.185]:62357: 535 Incorrect authentication data (set_id=skgoh@kendek.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:15:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:15:05 dovecot_login authenticator failed for H=(NLbZ6Em) [158.94.208.215]:60685: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:15:16 dovecot_login authenticator failed for H=(Lm9UWWZO) [158.94.208.175]:51499: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:15:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-31 16:16:16 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:43070: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:16:18 dovecot_login authenticator failed for H=(fV48qoIc) [178.16.54.22]:49556: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:16:23 dovecot_login authenticator failed for H=(bg8HV9FK1S) [158.94.208.175]:55360: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:16:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:16:17 dovecot_login authenticator failed for H=(5obQkFz9W) [158.94.208.215]:60249: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:16:48 dovecot_login authenticator failed for H=(A1kjMwy3q) [185.36.81.54]:51155: 535 Incorrect authentication data (set_id=png-sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:16:17 dovecot_login authenticator failed for H=(hrNRdBbuV) [158.94.208.215]:60247: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.63
country_id: 2921044
description:
2026-01-31 16:17:03 dovecot_login authenticator failed for H=(ADMIN) [77.90.185.63]:65484: 535 Incorrect authentication data (set_id=test@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: achieversvisionacademy.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/achieversvisiona/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-31 16:17:02 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:64826: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:17:09 dovecot_login authenticator failed for H=(xozIBUPm) [158.94.208.175]:59659: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:17:27 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:17:05 dovecot_login authenticator failed for H=(yhhjPLp) [158.94.208.215]:51127: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.69
country_id: 1880251
description:
2026-01-31 16:17:19 dovecot_login authenticator failed for H=(ADMIN) [156.146.57.69]:29668: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:17:26 dovecot_login authenticator failed for H=(1Canp1) [178.16.54.22]:58720: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:18:07 dovecot_login authenticator failed for H=(QOYL3GT6e6) [178.16.54.22]:54181: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:18:17 dovecot_login authenticator failed for H=(3ICyrgrxT) [158.94.208.215]:56288: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:18:10 dovecot_login authenticator failed for H=(gxU8VAmSW) [158.94.208.175]:54984: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:18:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:18:17 dovecot_login authenticator failed for H=(NV9j2X) [158.94.208.215]:56290: 535 Incorrect authentication data (set_id=hock)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.211.38
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=463&img=img/product_photos/942456.jpg&w=555 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:19:24 dovecot_login authenticator failed for H=(cogevKTN) [178.16.54.22]:51381: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.149.30.186
country_id: 2017370
description:
2026-01-31 16:19:39 dovecot_login authenticator failed for H=([83.149.30.186]) [83.149.30.186]:45682: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-31 16:19:46 dovecot_plain authenticator failed for H=(epent) [75.97.190.237]:43906: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-01-31 16:19:47 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:59144: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.169.244
country_id: 3017382
description:
2026-01-31 16:19:50 dovecot_plain authenticator failed for H=lstlambert-656-1-118-244.w80-14.abo.wanadoo.fr (howee) [80.14.169.244]:48978: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:19:03 dovecot_login authenticator failed for H=(l2FvXy) [158.94.208.215]:61782: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2026-01-31 16:19:17 dovecot_login authenticator failed for H=([49.124.155.162]) [49.124.155.162]:50010: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:19:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:19:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:19:07 dovecot_login authenticator failed for H=(Sna3t7gaL) [158.94.208.175]:58153: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.134
country_id: 1269750
description:
2026-01-31 16:20:03 dovecot_login authenticator failed for H=(aes-static-097.196.22.125.airtel.in) [125.23.237.134]:50430: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:20:13 dovecot_login authenticator failed for H=(Bym2ly) [158.94.208.175]:52446: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:20:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:20:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:20:15 dovecot_login authenticator failed for H=(i9ZVq7c) [158.94.208.215]:49368: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:20:15 dovecot_login authenticator failed for H=(ufpDSq34Th) [158.94.208.215]:49370: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 16:20:15 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:33246: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:20:25 dovecot_login authenticator failed for H=(YDvEDx) [178.16.54.22]:63865: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:20:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:21:03 dovecot_login authenticator failed for H=(kSs7asuLAh) [158.94.208.215]:58268: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:21:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.50
country_id: 2921044
description:
2026-01-31 16:21:33 dovecot_login authenticator failed for H=(oJ17Ac) [77.90.185.50]:60990: 535 Incorrect authentication data (set_id=info@mams.manforce.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.90.185.50
country_id: 2921044
description:
Jan 31 16:21:39 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(77.90.185.50)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:21:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:21:26 dovecot_login authenticator failed for H=(SScdnhjI9H) [158.94.208.175]:51141: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:21:26 dovecot_login authenticator failed for H=(eIBdH4Epm) [178.16.54.22]:51246: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:22:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:22:15 dovecot_login authenticator failed for H=(C3iqEEcXrw) [158.94.208.215]:62383: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:22:32 dovecot_login authenticator failed for H=(PE6aw0) [178.16.54.22]:53607: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:22:03 dovecot_login authenticator failed for H=(cUKk42yu) [158.94.208.175]:50875: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:22:07 dovecot_login authenticator failed for H=(RMDcLs) [185.36.81.54]:49412: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:22:15 dovecot_login authenticator failed for H=(ebhkerBx2) [158.94.208.215]:62399: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:23:03 dovecot_login authenticator failed for H=(Xvlumo) [158.94.208.215]:57770: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:23:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:23:30 H=([167.148.167.71]) [167.148.167.71]:64856 F=<Support@nexuscollection.com> rejected RCPT <admin@nexuscollection.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 16:23:44 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:49420: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:23:10 dovecot_login authenticator failed for H=(rFPAUmH5WH) [158.94.208.175]:54498: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:24:15 dovecot_login authenticator failed for H=(DuudJSe) [158.94.208.215]:59114: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:24:04 dovecot_login authenticator failed for H=(AYcgsLagD) [178.16.54.22]:49919: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:24:07 dovecot_login authenticator failed for H=(EDnzIhLQz2) [158.94.208.175]:62487: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:24:15 dovecot_login authenticator failed for H=(UZAgOT6cN) [158.94.208.215]:59115: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:25:02 dovecot_login authenticator failed for H=(RPiPDJwq) [158.94.208.175]:62040: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:25:03 dovecot_login authenticator failed for H=(1HN6H9vijI) [158.94.208.215]:49981: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.82
country_id: 1269750
description:
2026-01-31 16:25:48 dovecot_login authenticator failed for H=([182.95.231.82]) [182.95.231.82]:39802: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:25:51 dovecot_login authenticator failed for H=(2AHEhl5) [158.94.208.215]:56726: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-31 16:25:57 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:36208: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:26:15 dovecot_login authenticator failed for H=(jfPG379M10) [158.94.208.215]:51146: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.104.201.40
country_id: 1814991
description:
2026-01-31 16:26:51 dovecot_plain authenticator failed for H=(iv4f95gt4jh5fz26y48fomg8r) [39.104.201.40]:33554: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:26:28 dovecot_login authenticator failed for H=(yGWn5U) [178.16.54.22]:50609: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:26:27 dovecot_login authenticator failed for H=(gMSlneta) [158.94.208.175]:53820: 535 Incorrect authentication data (set_id=bentey@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 16:26:57 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:59400: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.163.233
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=595675 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:26:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:26:36 dovecot_login authenticator failed for H=(BNLvYNy9if) [185.36.81.54]:62512: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.94
country_id: 1269750
description:
2026-01-31 16:27:09 dovecot_login authenticator failed for H=(aes-static-049.93.22.125.airtel.in) [182.64.3.94]:36170: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:27:17 dovecot_login authenticator failed for H=(xovKROUVL) [158.94.208.175]:56856: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:27:03 dovecot_login authenticator failed for H=(EAgCH797) [158.94.208.215]:60355: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.63.7.250
country_id: 2921044
description:
2026-01-31 16:27:51 dovecot_login authenticator failed for H=p5b3f07fa.dip0.t-ipconnect.de [91.63.7.250]:62868: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:27:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-31 16:27:42 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:19094: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:27:51 dovecot_login authenticator failed for H=(dFBcSK) [158.94.208.215]:52881: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 182.42.113.10
country_id: 1814991
description:
Jan 31 16:28:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(182.42.113.10)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:28:06 dovecot_login authenticator failed for H=(GX6VesVpAD) [178.16.54.22]:56348: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:28:12 dovecot_login authenticator failed for H=(HtM9Pdtz) [158.94.208.175]:60092: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:28:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2026-01-31 16:28:36 dovecot_login authenticator failed for H=([182.42.113.10]) [182.42.113.10]:42856: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:28:46 dovecot_login authenticator failed for H=(wGhoPE) [185.36.81.54]:63019: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.189.191
country_id: 2017370
description:
2026-01-31 16:28:04 dovecot_login authenticator failed for H=([46.163.189.191]) [46.163.189.191]:47510: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:28:15 dovecot_login authenticator failed for H=(iNJ6ccwua) [158.94.208.215]:63389: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:29:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 103.107.36.18
country_id: 1269750
description:
Jan 31 16:29:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(103.107.36.18)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:29:51 dovecot_login authenticator failed for H=(v6BhcwYQUY) [158.94.208.215]:57914: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:29:13 dovecot_login authenticator failed for H=(0mvarxW) [178.16.54.22]:55168: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-31 16:29:30 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:60948: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2026-01-31 16:29:53 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:44650: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:29:03 dovecot_login authenticator failed for H=(4KFTk9D) [158.94.208.215]:49381: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:29:07 dovecot_login authenticator failed for H=(G5KiZquJ) [158.94.208.175]:53472: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 116.113.193.70
country_id: 1814991
description:
Jan 31 16:30:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(116.113.193.70)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 16:30:31 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:63444: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.smartcable.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/smartcable/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:30:29 dovecot_login authenticator failed for H=(iUpeDfVQ) [178.16.54.22]:62529: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:30:44 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:30:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:30:15 dovecot_login authenticator failed for H=(DhTrePo) [158.94.208.215]:51475: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:30:15 dovecot_login authenticator failed for H=(1Ukh9Xqr) [158.94.208.175]:63708: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
country_id: 1835841
description:
2026-01-31 16:30:17 dovecot_login authenticator failed for H=([119.195.77.177]) [119.195.77.177]:47301: 535 Incorrect authentication data (set_id=info@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.smartcable.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/smartcable/public_html/wp-content||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:31:27 dovecot_login authenticator failed for H=(4ajzs9Geiz) [158.94.208.215]:56404: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:31:28 dovecot_login authenticator failed for H=(74JUKsvqj) [178.16.54.22]:60160: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:31:48 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:31:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-31 16:31:38 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:43980: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 123.136.105.37
country_id: 1733045
domain: advisorygroup.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:123.136.105.37||TA:123.136.105.37||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:31:12 dovecot_login authenticator failed for H=(WD7Rnr4thj) [158.94.208.175]:62349: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:31:03 dovecot_login authenticator failed for H=(RUZzjX) [158.94.208.215]:59509: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-31 16:31:27 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:53144: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 16:32:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.175)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:32:36 H=([167.148.167.71]) [167.148.167.71]:57392 F=<Support@nexuscollection.com> rejected RCPT <alex@nexuscollection.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:32:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:32:14 dovecot_login authenticator failed for H=(YqxwE3hA) [178.16.54.22]:50834: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:32:15 dovecot_login authenticator failed for H=(sI5uhlBZ) [158.94.208.215]:63343: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:32:18 dovecot_login authenticator failed for H=(TPJd1s4dT) [158.94.208.175]:56449: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:33:02 dovecot_login authenticator failed for H=(KNCuc3A2) [158.94.208.175]:63613: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.254.25.158
country_id: 2017370
description:
2026-01-31 16:33:15 dovecot_login authenticator failed for H=([46.254.25.158]) [46.254.25.158]:53146: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:33:05 dovecot_login authenticator failed for H=(byeIFg) [178.16.54.22]:62336: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-31 16:33:23 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:33922: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:33:03 dovecot_login authenticator failed for H=(40Hw2dnvR) [158.94.208.215]:55250: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:33:27 dovecot_login authenticator failed for H=(oVS1s3V) [158.94.208.215]:51228: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:34:05 dovecot_login authenticator failed for H=(r3TiElWuR) [158.94.208.175]:59359: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-31 16:34:12 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:60255: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.137.66.82
country_id: 1835841
description:
2026-01-31 16:34:12 dovecot_login authenticator failed for H=([125.137.66.82]) [125.137.66.82]:1189: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:34:04 dovecot_login authenticator failed for H=(6R37go) [178.16.54.22]:63777: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.36.81.54
country_id: 597427
description:
2026-01-31 16:34:06 dovecot_login authenticator failed for H=(pbmnmMpaAA) [185.36.81.54]:58109: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:34:15 dovecot_login authenticator failed for H=(KwJ82VV2) [158.94.208.215]:56386: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-31 16:34:26 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:55587: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:35:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:35:27 dovecot_login authenticator failed for H=(UoxumPGc0) [158.94.208.215]:64408: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:35:03 dovecot_login authenticator failed for H=(nKAQa5G1) [158.94.208.215]:65396: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:35:13 dovecot_login authenticator failed for H=(4c19lKNgT) [178.16.54.22]:50850: 535 Incorrect authentication data (set_id=kywong.fpp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:35:16 dovecot_login authenticator failed for H=(iZYgUrhRk) [158.94.208.175]:52464: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:35:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2026-01-31 16:36:31 dovecot_login authenticator failed for H=([119.6.108.13]) [119.6.108.13]:43399: 535 Incorrect authentication data (set_id=admin@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-31 16:36:18 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:43745: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.19
country_id: 718075
description:
2026-01-31 16:36:19 dovecot_plain authenticator failed for H=([10.239.0.128]) [185.225.31.19]:24402: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-01-31 16:37:44 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:41008: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:37:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:37:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.25
country_id: 718075
description:
2026-01-31 16:37:06 dovecot_plain authenticator failed for H=([10.170.0.131]) [185.225.31.25]:55822: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 16:37:11 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:43782: 535 Incorrect authentication data (set_id=support@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-31 16:37:29 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:60152: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:37:48 dovecot_login authenticator failed for H=(rWEIapcxR) [158.94.208.215]:54756: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:37:57 dovecot_login authenticator failed for H=(MMXidQB) [158.94.208.175]:55418: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.255.5
country_id: 1814991
description:
2026-01-31 16:38:00 dovecot_login authenticator failed for H=([118.122.255.5]) [118.122.255.5]:54424: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2026-01-31 16:37:07 dovecot_login authenticator failed for H=([111.61.97.5]) [111.61.97.5]:29834: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 16:38:14 dovecot_login authenticator failed for H=(HONtO9u) [158.94.208.175]:49597: 535 Incorrect authentication data


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:38:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:38:08 dovecot_login authenticator failed for H=(P3fFuvCTDt) [158.94.208.215]:56632: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:38:46 dovecot_login authenticator failed for H=(UJNGNw) [158.94.208.215]:53146: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:38:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.202.245.25
country_id: 1210997
description:
2026-01-31 16:38:07 dovecot_login authenticator failed for H=([203.202.245.25]) [203.202.245.25]:36217: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:39:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:39:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(158.94.208.215)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-31 16:39:05 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:38698: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 16:39:33 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:19744: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:39:05 dovecot_login authenticator failed for H=(UMax5xz) [158.94.208.215]:62489: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.232.11
country_id: 1814991
description:
2026-01-31 16:40:56 dovecot_login authenticator failed for H=([27.45.232.11]) [27.45.232.11]:54624: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:40:02 dovecot_login authenticator failed for H=(sR7jXs) [158.94.208.215]:49285: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2026-01-31 16:40:06 dovecot_login authenticator failed for H=([116.114.84.170]) [116.114.84.170]:36787: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-31 16:40:10 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:39074: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:40:21 dovecot_login authenticator failed for H=(kc0YSs) [158.94.208.215]:63310: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 62.146.235.10
country_id: 1880251
domain: www.saps.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2026-01-31 16:41:12 dovecot_login authenticator failed for H=([61.186.136.36]) [61.186.136.36]:52973: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:41:18 dovecot_login authenticator failed for H=(nsjEZsJ7n) [158.94.208.215]:50632: 535 Incorrect authentication data (set_id=hock)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 62.146.235.10
country_id: 1880251
domain: www.saps.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/sapscom/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-31 16:41:39 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:50108: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:41:37 dovecot_login authenticator failed for H=(ORZtH3) [158.94.208.215]:56266: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:42:15 dovecot_login authenticator failed for H=(azfr0J) [158.94.208.215]:64542: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-31 16:42:28 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:35826: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:42:36 H=([167.148.167.71]) [167.148.167.71]:62203 F=<Support@aoto.com.my> rejected RCPT <aoto@aoto.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
country_id: 1814991
description:
2026-01-31 16:42:45 dovecot_login authenticator failed for H=([220.178.39.106]) [220.178.39.106]:48544: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:42:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 16:42:14 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:60786: 535 Incorrect authentication data (set_id=support@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:43:12 dovecot_login authenticator failed for H=(MV41GAtl) [158.94.208.215]:51261: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-01-31 16:43:42 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [182.76.107.16]:41688: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-01-31 16:43:54 dovecot_login authenticator failed for H=([220.118.190.204]) [220.118.190.204]:38708: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:43:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:43:12 dovecot_login authenticator failed for H=(lAL5tmh) [158.94.208.215]:51258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:44:09 dovecot_login authenticator failed for H=(Gw6sv4vpTN) [158.94.208.215]:62206: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-31 16:44:35 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:55372: 535 Incorrect authentication data (set_id=fasya)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 16:44:44 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:62654: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.88
country_id: 1814991
description:
2026-01-31 16:44:51 dovecot_login authenticator failed for H=([111.26.100.88]) [111.26.100.88]:51470: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:44:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-31 16:44:17 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:40960: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.1.56
country_id: 2017370
description:
2026-01-31 16:44:22 dovecot_login authenticator failed for H=broadband-5-228-1-56.ip.moscow.rt.ru [5.228.1.56]:58034: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:44:47 dovecot_login authenticator failed for H=(0moTIQFi0) [158.94.208.215]:57976: 535 Incorrect authentication data (set_id=hock)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:240641') and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211700
name: IM360 WAF: Detects conditional SQL injection attempts
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Detects conditional SQL injection attempts||RSV:7.71||T:APACHE||MVN:MATCHED_VAR||MV:240641/**//**/AND/**/1/**/GROUP/**/BY/**/CONCAT(0x5a4f3061,(SELECT/**/(ELT(2836=2836,1))),0x34644b46,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)#||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-01-31 16:45:09 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:47617: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.32.39.139
country_id: 2510769
description:
2026-01-31 16:45:23 dovecot_login authenticator failed for H=139.red-83-32-39.dynamicip.rima-tde.net [83.32.39.139]:55903: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:240641/**//**/or/**/(select/**/2*(if((select/**/*/**/from/**/(select/**/concat(0x5143354f,(select/**/(elt(2836=2836,1))),0x5a7a4a45))s),/**/8446744073709551610,/**/8446744073709551610)))||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2026-01-31 16:45:44 dovecot_login authenticator failed for H=([149.54.51.230]) [149.54.51.230]:35143: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: PHP Injection Low value||MV:240641/**//**/AND/**/EXP(~(SELECT/**/*/**/FROM/**/(SELECT/**/CONCAT(0x68534b66,(SELECT/**/(ELT(2836=2836,1))),0x4473595a))x))||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home/smartcable/public_html/news-details.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-31 16:45:02 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:36172: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:45:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 122.187.228.228
country_id: 1269750
description:
Jan 31 16:45:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(122.187.228.228)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:240641') and 1=1 union all select 1,null,'<script>alert(\"xss\")</etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:240641') AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.66
country_id: 1269750
description:
2026-01-31 16:45:36 dovecot_login authenticator failed for H=([182.95.231.66]) [182.95.231.66]:55872: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 16:45:39 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:45628: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:45:06 dovecot_login authenticator failed for H=(2MUXjfsrW) [158.94.208.215]:55107: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.138.178
country_id: 1814991
description:
2026-01-31 16:45:10 dovecot_login authenticator failed for H=([39.152.138.178]) [39.152.138.178]:54695: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:240641') AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77211700
name: IM360 WAF: Detects conditional SQL injection attempts
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Detects conditional SQL injection attempts||RSV:7.71||T:APACHE||MVN:MATCHED_VAR||MV:240641 /**/'/**/OR/**/1/**/GROUP/**/BY/**/CONCAT(0x52505777,(SELECT/**/REPEAT(0x33,150)),0x4f783549,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)##/**/XE3W||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:46:03 dovecot_login authenticator failed for H=(0h4IKeq) [158.94.208.215]:49601: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:46:03 dovecot_login authenticator failed for H=(K5MErun) [158.94.208.215]:49587: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-31 16:46:26 dovecot_login authenticator failed for H=([65.20.233.110]) [65.20.233.110]:60396: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.7
country_id: 1668284
description:
2026-01-31 16:46:40 dovecot_login authenticator failed for H=111-70-32-7.emome-ip.hinet.net [111.70.32.7]:33018: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:240641 /**/'/**/or/**/1/**/group/**/by/**/concat(0x52505777,(select/**/repeat(0x33,150)),0x4f783549,floor(rand(0)*2))/**/having/**/min(0)##/**/xe3w||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: PHP Injection Low value||MV:240641 /**/'/**/OR/**/1/**/GROUP/**/BY/**/CONCAT(0x52505777,(SELECT/**/REPEAT(0x33,150)),0x4f783549,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)##/**/XE3W||MVN:ARGS:id||RSV:7.71||T:APACHE||SC:/home/smartcable/public_html/news-details.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:240641 /**/'/**/OR/**/1/**/GROUP/**/BY/**/CONCAT(0x52505777,(SELECT/**/REPEAT(0x33,150)),0x4f783549,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)##/**/XE3W||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:46:20 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 185.156.46.146
country_id: 6252001
domain: www.smartcable.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:240641 /**/'/**/or/**/1/**/group/**/by/**/concat(0x52505777,(select/**/repeat(0x33,150)),0x4f783549,floor(rand(0)*2))/**/having/**/min(0)##/**/xe3w||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.35
country_id: 6252001
description:
2026-01-31 16:46:13 dovecot_login authenticator failed for H=(ADMIN) [140.228.24.35]:50443: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:46:41 dovecot_login authenticator failed for H=(fDPYVVYqzU) [69.5.189.21]:62059: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-31 16:47:25 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:54570: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:47:05 dovecot_login authenticator failed for H=(b9CcQAA) [69.5.189.21]:49550: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:47:19 dovecot_login authenticator failed for H=(ArVU9AXdK) [158.94.208.215]:52232: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-31 16:47:04 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:50920: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 50.235.31.47
country_id: 6252001
description:
Jan 31 16:47:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(50.235.31.47)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:47:38 dovecot_login authenticator failed for H=(Ju2hBizyTj) [158.94.208.215]:58246: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:47:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 217.182.79.131
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/img/img/demos/img/demos/img/photos/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:48:16 dovecot_login authenticator failed for H=(7VRvbmg4) [158.94.208.215]:52090: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:48:38 dovecot_login authenticator failed for H=(3ASpWHaimN) [69.5.189.21]:64914: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:49:13 dovecot_login authenticator failed for H=(dueQxR) [158.94.208.215]:51080: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.169.176
country_id: 2017370
description:
2026-01-31 16:49:55 dovecot_login authenticator failed for H=(31-220-169-176.rdtc.ru) [31.220.169.176]:44301: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:49:02 dovecot_login authenticator failed for H=(39B3bTt2u) [69.5.189.21]:52503: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.242
country_id: 6252001
description:
2026-01-31 16:49:36 dovecot_login authenticator failed for H=(ADMIN) [50.6.250.242]:41852: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:49:13 dovecot_login authenticator failed for H=(ED8O7Juviq) [158.94.208.215]:51079: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:49:18 H=([167.148.167.71]) [167.148.167.71]:50861 F=<Support@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:50:35 dovecot_login authenticator failed for H=(rbpjLN6zQ0) [69.5.189.21]:51646: 535 Incorrect authentication data (set_id=kl.tai@nmahir.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:50:46 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:50:10 dovecot_login authenticator failed for H=(n7ml27cdp) [158.94.208.215]:55228: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.175.54.146
country_id: 6252001
domain: af-sb.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:192.175.54.146||TA:192.175.54.146||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-01-31 16:50:24 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:58122: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:50:29 dovecot_login authenticator failed for H=(W0yBO69gE) [158.94.208.215]:51291: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.175.182
country_id: 357994
description:
2026-01-31 16:52:00 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.175.182]:37972: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 16:51:22 dovecot_login authenticator failed for H=(KMeuBU) [69.5.189.21]:59520: 535 Incorrect authentication data (set_id=kl.tai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-01-31 16:51:33 dovecot_login authenticator failed for H=([74.195.53.129]) [74.195.53.129]:33916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-31 16:51:40 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:40129: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.249.20.14
country_id: 1814991
description:
2026-01-31 16:51:56 dovecot_login authenticator failed for H=([140.249.20.14]) [140.249.20.14]:42875: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.113.27
country_id: 1835841
description:
2026-01-31 16:51:28 dovecot_login authenticator failed for H=([211.228.113.27]) [211.228.113.27]:58464: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 16:51:02 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:39778: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:51:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account hock has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:51:07 dovecot_login authenticator failed for H=(dOTtGpM) [158.94.208.215]:58564: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-31 16:51:13 dovecot_login authenticator failed for H=([152.52.238.54]) [27.123.92.202]:42732: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 211.228.113.27
country_id: 1835841
description:
Jan 31 16:51:26 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(211.228.113.27)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:52:05 dovecot_login authenticator failed for H=(oRqLVu5) [158.94.208.215]:62155: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.85.183
country_id: 690791
description:
2026-01-31 16:52:06 dovecot_login authenticator failed for H=(host183-85-16-178.reedlan.com) [178.16.85.183]:50269: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:52:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:52:05 dovecot_login authenticator failed for H=(3hee1uDUi) [158.94.208.215]:62150: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.134
country_id: 2017370
description:
2026-01-31 16:52:14 dovecot_login authenticator failed for H=([178.178.194.134]) [178.178.194.134]:39874: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:53:02 dovecot_login authenticator failed for H=(YoR4syRt9r) [158.94.208.215]:53475: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.239
country_id: 3469034
description:
2026-01-31 16:53:23 dovecot_login authenticator failed for H=([187.50.118.81]) [177.174.122.239]:55019: 535 Incorrect authentication data (set_id=teng@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: fasterget.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/fastg/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.231.100
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=211364 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-31 16:53:49 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:59880: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:53:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:53:40 dovecot_login authenticator failed for H=(GqqV7AaMND) [158.94.208.215]:53930: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:54:56 dovecot_login authenticator failed for H=(yRzHLawsgt) [158.94.208.215]:51532: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.8.226.231
country_id: 1643084
description:
2026-01-31 16:54:57 dovecot_plain authenticator failed for H=(CUF28CYXYG583UI9) [182.8.226.231]:45193: 535 Incorrect authentication data (set_id=francis.info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: fasterget.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/fastg/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:54:18 dovecot_login authenticator failed for H=(EV2thvb1) [158.94.208.215]:64725: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:54:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account sales has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.215
country_id: 2921044
description:
Jan 31 16:55:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.208.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-31 16:55:54 dovecot_login authenticator failed for H=([95.79.108.51]) [95.79.108.51]:37714: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.8.226.231
country_id: 1643084
description:
2026-01-31 16:55:03 dovecot_login authenticator failed for H=(CUF28CYXYG583UI9) [182.8.226.231]:45193: 535 Incorrect authentication data (set_id=francis.info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/mokshanacom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.215
country_id: 2921044
description:
2026-01-31 16:55:15 dovecot_login authenticator failed for H=(aYHrax0G) [158.94.208.215]:56179: 535 Incorrect authentication data (set_id=hock)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2026-01-31 16:56:13 dovecot_login authenticator failed for H=([49.124.146.42]) [49.124.146.42]:49894: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2026-01-31 16:56:28 dovecot_login authenticator failed for H=([221.145.5.14]) [221.145.5.14]:58941: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2026-01-31 16:56:38 dovecot_login authenticator failed for H=([1.30.20.98]) [1.30.20.98]:44008: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 16:56:55 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:41420: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.169.24
country_id: 1861060
domain: mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/mokshanacom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-01-31 16:56:36 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:40484: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-31 16:56:45 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:36484: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.54.82
country_id: 1269750
description:
2026-01-31 16:56:07 dovecot_login authenticator failed for H=(dsl-tn-dynamic-201.116.246.61.airtelbroadband.in) [122.187.54.82]:44990: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 16:57:43 H=([167.148.167.71]) [167.148.167.71]:55734 F=<Support@ms-chemicals.net> rejected RCPT <boolan@ms-chemicals.net>: smtp auth required


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 147.135.252.182
country_id: 3017382
domain: krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/webdesign.monkeymedia2u.com||User:krisfood||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:57:42 dovecot_login authenticator failed for H=(iM0dfX9Ty) [178.16.54.22]:62963: 535 Incorrect authentication data (set_id=tinghou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.116
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=10 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:58:16 dovecot_login authenticator failed for H=(ftiP4rAQV) [178.16.54.22]:60207: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2026-01-31 16:58:44 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:37248: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2026-01-31 16:58:52 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:57266: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2026-01-31 16:58:49 dovecot_login authenticator failed for H=([182.74.12.86]) [182.74.12.86]:45044: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 16:59:23 dovecot_login authenticator failed for H=(l9sWKNZ) [178.16.54.22]:55369: 535 Incorrect authentication data (set_id=tinghou)


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/masaakisb/public_html/wp-content/plugins/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 16:59:04 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:2353: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/inputs.php||SC:/home/masaakisb/public_html/wp-content/uploads/inputs.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 17:01:30 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:47362: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/masaakisb/public_html/geju.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: www.wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/woh/wcc.com.my/wp-admin/images/commentv.php||


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-31 17:01:33 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:58916: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:01:40 dovecot_login authenticator failed for H=(lLIWw7K8y) [178.16.54.22]:54666: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-31 17:01:53 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:33862: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-31 17:01:52 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:40850: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-31 17:02:49 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:51143: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.203.132.68
country_id: 2658434
domain: www.wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/wp-conflg.php||SC:/home2/woh/wcc.com.my/wp-admin/images/wp-conflg.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-31 17:03:29 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:46266: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2026-01-31 17:03:04 dovecot_login authenticator failed for H=([50.123.92.130]) [50.123.92.130]:42260: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/masaakisb/public_html/wp.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:03:16 dovecot_login authenticator failed for H=(6gVSwd) [178.16.54.22]:59723: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:03:21 H=([167.148.167.71]) [167.148.167.71]:62782 F=<Support@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 144.172.92.223
country_id: 6252001
domain: masaakisb.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-31 17:03:09 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:40526: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2026-01-31 17:03:59 dovecot_login authenticator failed for H=([178.178.222.58]) [178.178.222.58]:49298: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:04:42 dovecot_login authenticator failed for H=(xB93Hbu) [178.16.54.22]:65206: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.251.22
country_id: 2017370
description:
2026-01-31 17:04:57 dovecot_login authenticator failed for H=([79.135.251.22]) [79.135.251.22]:38834: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-31 17:04:09 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:41303: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2026-01-31 17:04:36 dovecot_login authenticator failed for H=([211.223.41.90]) [211.223.41.90]:51888: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-31 17:05:00 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:57721: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-31 17:04:06 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:58426: 535 Incorrect authentication data (set_id=support@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 17:04:15 dovecot_login authenticator failed for H=([218.106.120.18]) [58.49.113.138]:13707: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-01-31 17:04:20 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:44519: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.75.196
country_id: 1269750
description:
2026-01-31 17:04:44 dovecot_plain authenticator failed for H=(398XN2FAL8) [59.93.75.196]:52220: 535 Incorrect authentication data (set_id=joyo@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-01-31 17:05:31 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:46921: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:05:20 dovecot_login authenticator failed for H=(u4K8pgq) [178.16.54.22]:65306: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2026-01-31 17:05:22 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:43170: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 101.200.243.197
country_id: 1814991
description:
2026-01-31 17:05:21 44165 [Warning] Aborted connection 44165 to db: 'unconnected' user: 'unauthenticated' host: '101.200.243.197' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.47.16.15
country_id: 1880251
description:
2026-01-31 17:06:23 dovecot_plain authenticator failed for H=(t7tdmb838ootj8csk7v) [101.47.16.15]:36182: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.200.184.216
country_id: 248816
description:
2026-01-31 17:06:03 dovecot_plain authenticator failed for H=(56QUULLY) [149.200.184.216]:28121: 535 Incorrect authentication data (set_id=kelveen.info@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-31 17:06:17 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:17435: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 17:06:03 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:49588: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:07:55 dovecot_login authenticator failed for H=(8SlWtn) [178.16.54.22]:65372: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-31 17:07:07 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:60819: 535 Incorrect authentication data (set_id=admin@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-31 17:07:30 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:48834: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-31 17:08:44 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:51554: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:09:00 dovecot_login authenticator failed for H=(dffnZWe4r) [178.16.54.22]:57650: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.150
country_id: 1269750
description:
2026-01-31 17:08:39 dovecot_login authenticator failed for H=(nsg-corporate-150.230.187.122.airtel.in) [122.187.230.150]:44553: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-31 17:08:13 H=([45.144.212.50]) [45.144.212.50]:51418 F=<ccmsservice@bangkokbank.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from bangkokbank.com


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.236.207.248
country_id: 6252001
domain: ahfengineering.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.30.250.62
country_id: 690791
description:
2026-01-31 17:08:53 dovecot_login authenticator failed for H=(undefined.sevstar.net) [78.30.250.62]:58070: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.162.16
country_id: 1269750
description:
2026-01-31 17:08:28 dovecot_plain authenticator failed for H=(Q3OS5) [49.204.162.16]:32449: 535 Incorrect authentication data (set_id=lilian@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:09:36 dovecot_login authenticator failed for H=(VqatqX5glE) [178.16.54.22]:61654: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 31 17:10:16 sv3 sshd[112509]: Accepted publickey for root from 10.1.14.100 port 62516 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:10:24 dovecot_login authenticator failed for H=(2N6fq4bt6) [178.16.54.22]:64630: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.109.66.101
country_id: 1527747
description:
2026-01-31 17:10:57 dovecot_plain authenticator failed for H=(GXA8DC) [213.109.66.101]:53461: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.109.66.101
country_id: 1527747
description:
2026-01-31 17:11:03 dovecot_login authenticator failed for H=(GXA8DC) [213.109.66.101]:53461: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:11:06 dovecot_login authenticator failed for H=(zo0Qx4) [178.16.54.22]:55420: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:12:42 dovecot_login authenticator failed for H=(zNhwWesp) [178.16.54.22]:51299: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 17:13:24 dovecot_login authenticator failed for H=(y6KTInvM) [158.94.208.110]:61849: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2026-01-31 17:13:35 dovecot_login authenticator failed for H=([218.146.255.221]) [218.146.255.221]:59445: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 168.149.98.56
country_id: 102358
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/modprobe.d/dist-alsa.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 17:13:45 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1276: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:13:15 dovecot_login authenticator failed for H=(Ul9905) [178.16.54.22]:60810: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-31 17:13:22 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:33862: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.148.167.71
country_id: 6252001
description:
2026-01-31 17:13:36 H=([167.148.167.71]) [167.148.167.71]:61636 F=<Support@ajplantations.com.my> rejected RCPT <corporate_ch@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 17:14:12 dovecot_login authenticator failed for H=(SGm5Q73dVp) [158.94.208.110]:52585: 535 Incorrect authentication data (set_id=azakaria.vpb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.151
country_id: 660013
description:
2026-01-31 17:14:37 dovecot_login authenticator failed for H=(ADMIN) [188.126.89.151]:45113: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2026-01-31 17:14:02 dovecot_login authenticator failed for H=(nsg-corporate-81.230.187.122.airtel.in) [122.187.230.81]:52143: 535 Incorrect authentication data (set_id=support@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:14:11 dovecot_login authenticator failed for H=(6s7Q037B) [178.16.54.22]:51053: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-01-31 17:15:48 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:39619: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-31 17:15:56 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:36520: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-31 17:15:02 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:59260: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 17:15:45 dovecot_login authenticator failed for H=(kOWtIS0) [158.94.208.110]:51439: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2026-01-31 17:15:29 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:44887: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.218.97
country_id: 1814991
description:
2026-01-31 17:15:43 dovecot_login authenticator failed for H=([111.26.218.96]) [111.26.218.97]:39114: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:15:17 dovecot_login authenticator failed for H=(C1AHMQWRT) [178.16.54.22]:57748: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-31 17:16:46 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:45646: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2026-01-31 17:16:05 dovecot_login authenticator failed for H=([92.126.223.175]) [92.126.223.175]:41522: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:16:53 dovecot_login authenticator failed for H=(f3USJ4sKiZ) [178.16.54.22]:53787: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.200.86
country_id: 1814991
description:
2026-01-31 17:16:29 dovecot_login authenticator failed for H=([220.189.239.206]) [61.130.200.86]:57716: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 17:16:09 dovecot_login authenticator failed for H=(VILNzSKf) [158.94.208.110]:55481: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.216.202
country_id: 1269750
domain: dps-comsec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60513.dps-comsec.com||ServerName:dps-comsec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e2f8aa3db42525ade25476e342c1ecfcb2970b3||Title:0x658dc991||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.92
country_id: 3865483
description:
2026-01-31 17:17:53 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.92]:45414: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2026-01-31 17:17:55 dovecot_login authenticator failed for H=(213-91-179-26.btc-net.bg) [213.91.179.26]:36228: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.51
country_id: 1733045
description:
2026-01-31 17:17:09 dovecot_login authenticator failed for H=([49.124.151.51]) [49.124.151.51]:55372: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:17:27 dovecot_login authenticator failed for H=(wKHAGJ39PT) [178.16.54.22]:56569: 535 Incorrect authentication data (set_id=tinghou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: xls.mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/mokshanacom/xls.mokshana.com.my/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:20:01 dovecot_login authenticator failed for H=(bgmVbq) [178.16.54.22]:62127: 535 Incorrect authentication data (set_id=tinghou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: xls.mokshana.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/mokshanacom/xls.mokshana.com.my/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.71.41
country_id: 6252001
description:
2026-01-31 17:20:26 dovecot_login authenticator failed for H=([209.23.71.41]) [209.23.71.41]:33306: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 147.235.221.164
country_id: 294640
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/root/lib/modprobe.d/dist-blacklist.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:20:45 dovecot_login authenticator failed for H=(svLzHIYL) [178.16.54.22]:63585: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:20:46 dovecot_login authenticator failed for H=(J0XEho02L6) [69.5.189.21]:55833: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.185.190
country_id: 1269750
description:
2026-01-31 17:20:13 dovecot_login authenticator failed for H=(nsg-corporate-190.185.185.122.airtel.in) [122.185.185.190]:60870: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:21:09 dovecot_login authenticator failed for H=(PH1sn4cD6) [69.5.189.21]:59717: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.78.117.160
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=6 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:21:45 dovecot_login authenticator failed for H=(IxgTj9) [178.16.54.22]:61131: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-31 17:22:50 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:45504: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-01-31 17:22:27 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:50688: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/kdiballo1/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.174.216
country_id: 2017370
description:
2026-01-31 17:22:42 dovecot_login authenticator failed for H=([46.163.174.216]) [46.163.174.216]:32944: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:22:18 dovecot_login authenticator failed for H=(R20GrvW) [178.16.54.22]:55289: 535 Incorrect authentication data (set_id=tinghou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.237.183.81
country_id: 690791
description:
2026-01-31 17:22:48 dovecot_login authenticator failed for H=([91.237.183.81]) [91.237.183.81]:51412: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:22:42 dovecot_login authenticator failed for H=(64KjF8esQc) [69.5.189.21]:58184: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/swiper.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-31 17:23:54 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:58136: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.189
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/popper.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/wow.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.166
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/animate.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.127.130
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12581514861377 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.216
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/owl.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.240
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/fonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/owl.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/fonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/swiper.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.214
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/script.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.188
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/appear.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/flaticon.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-31 17:23:37 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:57571: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:23:55 dovecot_login authenticator failed for H=(jmwMss6) [178.16.54.22]:61775: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.251
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/jquery.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/tm-utility-classes.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/bootstrap.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.231
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/jquery.fancybox.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/tm-bs-mp.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.202
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/linear.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.250
country_id: 1814991
description:
2026-01-31 17:23:07 dovecot_login authenticator failed for H=([219.128.55.250]) [219.128.55.250]:59777: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2026-01-31 17:23:30 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:38529: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/responsive.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.201
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/style.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.246
country_id: 1835841
description:
2026-01-31 17:23:44 dovecot_login authenticator failed for H=([112.164.234.246]) [112.164.234.246]:38338: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-01-31 17:23:07 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:32968: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.227
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/jquery-ui.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:23:06 dovecot_login authenticator failed for H=(ewq1PH) [69.5.189.21]:61876: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.126.158.156
country_id: 630336
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/corporate-profile.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.239
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/css/bootstrap.min.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.tptec.com.my/js/select2.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:24:39 dovecot_login authenticator failed for H=(E04mA2As) [69.5.189.21]:60384: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.249.7.24
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88451514882760 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 17:25:03 dovecot_login authenticator failed for H=(yhaJvm) [69.5.189.21]:59471: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:25:34 dovecot_login authenticator failed for H=(CCTPMaIwhB) [178.16.54.22]:61732: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.84.220.181
country_id: 1269750
domain: ds-staffing.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:76536.ds-staffing.com||ServerName:ds-staffing.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:797d42cc551fc9ed095b73f5414c3470143855fe||Title:0x6b46f179||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 17:26:52 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:34642: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 17:26:56 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:52065: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:26:49 dovecot_login authenticator failed for H=(IGQqxRbJaf) [178.16.54.22]:50824: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-01-31 17:26:52 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:52574: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.50.88
country_id: 2017370
description:
2026-01-31 17:27:14 dovecot_login authenticator failed for H=88-50-255-130.kamensktel.ru [130.255.50.88]:52952: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
country_id: 1814991
description:
2026-01-31 17:27:23 dovecot_login authenticator failed for H=([116.113.193.70]) [116.113.193.70]:56561: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-31 17:27:23 dovecot_login authenticator failed for H=(ipoe-static.mosoblast.rt.ru) [89.109.233.181]:55239: 535 Incorrect authentication data (set_id=admin@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2026-01-31 17:27:45 dovecot_login authenticator failed for H=([111.61.177.189]) [111.61.177.189]:17976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.143
country_id: 1668284
description:
2026-01-31 17:27:48 dovecot_login authenticator failed for H=111-70-28-143.emome-ip.hinet.net [111.70.28.143]:49030: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-31 17:27:28 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:34188: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:27:28 dovecot_login authenticator failed for H=(QDVEQA0IH) [178.16.54.22]:62405: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-31 17:27:21 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:44766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 17:27:21 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:5384: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-31 17:27:39 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:50278: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2026-01-31 17:27:46 dovecot_login authenticator failed for H=([221.199.172.66]) [221.199.172.66]:47102: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:28:11 dovecot_login authenticator failed for H=(EGk1OkCZzH) [178.16.54.22]:64109: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.107.237.126
country_id: 1835841
description:
2026-01-31 17:28:06 dovecot_login authenticator failed for H=([211.107.237.126]) [211.107.237.126]:52004: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 17:28:48 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57687: 535 Incorrect authentication data (set_id=test@aircarbonic.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.203.111
country_id: 298795
description:
2026-01-31 17:29:56 dovecot_login authenticator failed for H=([5.26.203.111]) [5.26.203.111]:60684: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:29:21 dovecot_login authenticator failed for H=(GEktMHK) [178.16.54.22]:61187: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.159.77
country_id: 1668284
description:
2026-01-31 17:30:47 dovecot_login authenticator failed for H=(ADMIN) [213.209.159.77]:57639: 535 Incorrect authentication data (set_id=test@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-01-31 17:30:12 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:13192: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.38.185
country_id: 2658434
description:
2026-01-31 17:30:03 dovecot_login authenticator failed for H=(dyn-cable-cust.185.38.202.213.quicknet.ch) [213.202.38.185]:53228: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 17:30:28 dovecot_login authenticator failed for H=(YLgKLIWYP7) [178.16.54.22]:50333: 535 Incorrect authentication data (set_id=tinghou@col.com.my)


