# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:52:18 dovecot_login authenticator failed for H=(ETXLt5GW) [178.16.54.22]:56691: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:52:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:52:11 dovecot_login authenticator failed for H=(gAjKMLmz) [158.94.208.175]:61124: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:52:45 dovecot_login authenticator failed for H=(p6dBt6ol4) [158.94.208.175]:50847: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:52:02 dovecot_login authenticator failed for H=(cFu2OOvfN) [185.230.124.69]:65473: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.163
country_id: 2750405
description:
2026-01-31  0:53:20 2271 [Warning] Aborted connection 2271 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.163' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.146.93.14
country_id: 1668284
description:
2026-01-31 00:53:57 dovecot_login authenticator failed for H=(122-146-93-14.adsl.static.sparqnet.net) [122.146.93.14]:43568: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:53:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:53:04 dovecot_login authenticator failed for H=(uWWvtI9) [2.58.56.77]:49196: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.18.3
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/tuju7822/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:53:22 dovecot_login authenticator failed for H=(qFLEIZ1c) [158.94.208.175]:50139: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:53:08 dovecot_login authenticator failed for H=(LHpyoL) [185.230.124.69]:51979: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:53:22 dovecot_login authenticator failed for H=(IXv8IB) [178.16.54.22]:55270: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-31 00:54:48 dovecot_login authenticator failed for H=([182.79.70.225]) [182.95.230.134]:55520: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:54:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:54:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.64
country_id: 1668284
description:
2026-01-31 00:54:11 dovecot_login authenticator failed for H=111-70-19-64.emome-ip.hinet.net [111.70.19.64]:59917: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:54:15 dovecot_login authenticator failed for H=(ynd5nkG) [185.230.124.69]:58355: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.163
country_id: 2750405
description:
2026-01-31  0:54:51 2344 [Warning] Aborted connection 2344 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.163' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 00:54:55 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:50134: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:54:04 dovecot_login authenticator failed for H=(JeNBfX7j8) [178.16.54.22]:51010: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:54:18 dovecot_login authenticator failed for H=(JXm0P5) [158.94.208.175]:63505: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-01-31 00:54:18 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [14.96.29.14]:35872: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.232.191.178
country_id: 1814991
description:
2026-01-31 00:54:21 dovecot_login authenticator failed for H=([123.232.191.178]) [123.232.191.178]:44251: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:54:08 dovecot_login authenticator failed for H=(kltPQnVE) [2.58.56.77]:49969: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-31 00:54:32 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:52460: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:55:25 dovecot_login authenticator failed for H=(rOOsoYexK) [185.230.124.69]:65472: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:55:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:55:10 dovecot_login authenticator failed for H=(EbrqnF9f) [178.16.54.22]:56241: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:55:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:55:10 dovecot_login authenticator failed for H=(XVLgu0GM) [158.94.208.175]:61579: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:55:16 dovecot_login authenticator failed for H=(2I0YjY) [2.58.56.77]:59709: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:55:23 dovecot_login authenticator failed for H=(hX6KYaHo) [158.94.208.175]:56707: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 20.212.211.10
country_id: 1880251
domain: mckd.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:56:24 dovecot_login authenticator failed for H=(Ve1t3nWQTM) [2.58.56.77]:58971: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 52.80.164.128
country_id: 1814991
domain: www.oxbold.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PFFM10 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36 aweme_250000 JsSdk/1.0 NetType/WIFI Channel/31725782a AppName/aweme app_version/25.0.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BULLET/1 BytedanceWebview/d8a21c6 TTWebView/0881130048402||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.124.76.171
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/company/introduction/showroom/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 113.211.120.79
country_id: 1733045
domain: www.oxbold.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 doubao_12.0.0 JsSdk/2.0 NetType/MOBILE Channel/App Store Rifle_12.0.0 WKWebView/1 Bullet/1 doubao/12.0.0 BulletTag/9C5CC2EE-3A83-4505-8818-095CD73919C2 BytedanceWebview/d8a21c6 aid/482431 argus_biz/anniex FalconTag/F998E724-3A33-4DFC-A50E-674193D9F3F0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:56:06 dovecot_login authenticator failed for H=(2EJCEKS) [158.94.208.175]:50933: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 00:56:15 H=(localhost.localdomain) [78.153.140.207]:51192 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.214
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:56:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:56:15 dovecot_login authenticator failed for H=(oizcXycq) [185.230.124.69]:52470: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-31 00:57:41 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:40724: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:57:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:57:08 dovecot_login authenticator failed for H=(vsbHYq) [2.58.56.77]:49161: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 00:57:49 H=(localhost.localdomain) [78.153.140.207]:50172 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:57:57 dovecot_login authenticator failed for H=(pbhq3k) [178.16.54.22]:56526: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:57:03 dovecot_login authenticator failed for H=(audcaHDY7) [185.230.124.69]:54326: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:57:02 dovecot_login authenticator failed for H=(BdWwY87pg) [158.94.208.175]:53319: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:58:19 dovecot_login authenticator failed for H=(ummjhnM) [2.58.56.77]:63570: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:58:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-31 00:58:04 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:44077: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 00:58:18 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1516: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:58:03 dovecot_login authenticator failed for H=(VVhBMzzDqU) [158.94.208.175]:52129: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 00:58:29 dovecot_login authenticator failed for H=(RS0bdCd) [178.16.54.22]:59517: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:58:15 dovecot_login authenticator failed for H=(yDol0YCX) [185.230.124.69]:49290: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:58:40 dovecot_login authenticator failed for H=(XKNCAUw) [185.230.124.69]:59737: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-31 00:58:11 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:42590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 00:59:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 49.12.5.146
country_id: 2921044
domain: feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 00:59:03 dovecot_login authenticator failed for H=(oebvFR) [2.58.56.77]:61221: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 00:59:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 00:59:13 dovecot_login authenticator failed for H=(WVPjEBIU7r) [158.94.208.175]:56782: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 00:59:23 dovecot_login authenticator failed for H=(gfQYodPu) [69.5.189.21]:65095: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Tests/fixtures/resourcebundle/corrupted/resources.dat||User:visoftcom||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.23.179.35
country_id: 2921044
description:
[2026-01-31 00:59:39 +0800] info [webmaild] 203.23.179.35 - project@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 00:59:05 dovecot_login authenticator failed for H=(dhCrz3blo3) [185.230.124.69]:49948: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2026-01-31 00:59:49 dovecot_login authenticator failed for H=([115.141.143.58]) [115.141.143.58]:59241: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-31 01:00:01 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:39718: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-31 01:00:44 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:60468: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.159.21
country_id: 2017370
description:
2026-01-31 01:00:52 dovecot_login authenticator failed for H=([46.163.159.21]) [46.163.159.21]:41874: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:00:02 dovecot_login authenticator failed for H=(4Zz1kfQM8) [178.16.54.22]:55339: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:00:10 dovecot_login authenticator failed for H=(gqdX2nKBe) [69.5.189.21]:56414: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:00:13 dovecot_login authenticator failed for H=(stqIZS) [158.94.208.175]:52503: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:00:15 dovecot_login authenticator failed for H=(ysai2NRt) [2.58.56.77]:62041: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:00:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:00:20 dovecot_login authenticator failed for H=(LNeiaoZ35n) [185.230.124.69]:57263: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-31 01:00:40 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:47154: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:01:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:01:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:01:20 dovecot_login authenticator failed for H=(ygNlbst) [69.5.189.21]:52074: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:01:21 dovecot_login authenticator failed for H=(KsUDNOPFYD) [2.58.56.77]:52213: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.67.146
country_id: 2017370
description:
2026-01-31 01:01:01 dovecot_login authenticator failed for H=([31.173.67.146]) [31.173.67.146]:55608: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:01:03 dovecot_login authenticator failed for H=(IB7wdVZx) [185.230.124.69]:49175: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:01:07 dovecot_login authenticator failed for H=(18eYJb) [178.16.54.22]:59063: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:01:01 dovecot_login authenticator failed for H=(tTjq6X3r) [158.94.208.175]:62552: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:01:34 dovecot_login authenticator failed for H=(yT0KBghdw) [185.230.124.69]:53282: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:02:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:02:05 dovecot_login authenticator failed for H=(FVWsy2kWP) [2.58.56.77]:58111: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:02:08 dovecot_login authenticator failed for H=(mD7tQ7) [69.5.189.21]:60047: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:02:09 dovecot_login authenticator failed for H=(nLZk2V) [158.94.208.175]:60904: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:02:19 dovecot_login authenticator failed for H=(5Z3vMA) [185.230.124.69]:54414: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-01-31 01:02:37 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:33674: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:02:50 dovecot_login authenticator failed for H=(NEJmYfrUXi) [178.16.54.22]:49739: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 01:02:04 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:59650: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/contact.php||SC:/home/indfinitydesign/public_html/img/photos/contact.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
country_id: 1814991
description:
2026-01-31 01:02:20 dovecot_login authenticator failed for H=([210.13.99.68]) [210.13.99.66]:3735: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:02:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2026-01-31 01:02:53 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:51142: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.127.4
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/hamcrest/hamcrest-php/hamcrest/Hamcrest/Internal HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.52.127
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/hamcrest/hamcrest-php/hamcrest/Hamcrest/Internal/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:03:09 dovecot_login authenticator failed for H=(KFyHbOMlC) [185.230.124.69]:62237: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.80
country_id: 2782113
description:
2026-01-31 01:03:00 dovecot_login authenticator failed for H=(ADMIN) [156.146.60.80]:7846: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:03:05 dovecot_login authenticator failed for H=(JgQMh0IBvQ) [2.58.56.77]:53411: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:03:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:03:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:03:12 dovecot_login authenticator failed for H=(sLCSZJ) [158.94.208.175]:49417: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:03:17 dovecot_login authenticator failed for H=(no7wqBeq) [69.5.189.21]:61387: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:04:04 dovecot_login authenticator failed for H=(0nfVxyRFl) [185.230.124.69]:56192: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:04:55 dovecot_login authenticator failed for H=(69hd5FB) [178.16.54.22]:63072: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 01:04:05 dovecot_login authenticator failed for H=(QCWZjLz) [69.5.189.21]:53139: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.168.104.170
country_id: 1814991
description:
2026-01-31 01:04:27 dovecot_login authenticator failed for H=(pc170.zz.ha.cn) [61.168.104.170]:57378: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:04:30 dovecot_login authenticator failed for H=(QKyEdqotzs) [185.230.124.69]:51759: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:04:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:04:10 dovecot_login authenticator failed for H=(pyPFZtJ) [2.58.56.77]:49876: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:04:23 dovecot_login authenticator failed for H=(GqtvrtHpw) [158.94.208.175]:56706: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-31 01:04:42 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:47894: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.42.67.114
country_id: 1814991
description:
2026-01-31 01:04:56 dovecot_login authenticator failed for H=([36.42.67.114]) [36.42.67.114]:48920: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:05:13 dovecot_login authenticator failed for H=(d3Jxa4) [185.230.124.69]:51949: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:05:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:05:18 dovecot_login authenticator failed for H=(kRBQv2UZ) [158.94.208.175]:61537: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:05:22 dovecot_login authenticator failed for H=(sD47cH) [2.58.56.77]:54163: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:05:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:05:23 dovecot_login authenticator failed for H=(oOYYtfJf) [178.16.54.22]:54311: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2026-01-31 01:05:37 dovecot_login authenticator failed for H=([107.85.14.208]) [107.85.14.208]:37061: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.125
country_id: 6252001
description:
2026-01-31  1:05:40 2801 [Warning] Aborted connection 2801 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.125' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:06:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:06:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:06:07 dovecot_login authenticator failed for H=(B7CwHmG) [2.58.56.77]:61334: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:06:08 dovecot_login authenticator failed for H=(RVsbvnlD) [158.94.208.175]:51750: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:06:06 dovecot_login authenticator failed for H=(qufK3gof) [185.230.124.69]:51659: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:06:10 dovecot_login authenticator failed for H=(m2T8PiR) [178.16.54.22]:53673: 535 Incorrect authentication data (set_id=rosliza)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-1.2-strict.xsd||User:visoftcom||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:06:36 dovecot_login authenticator failed for H=(GAUoVbP) [185.230.124.69]:49773: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 01:07:49 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:36205: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:07:02 dovecot_login authenticator failed for H=(HxUVVac21U) [185.230.124.69]:59396: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:07:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:07:21 dovecot_login authenticator failed for H=(o2mEefxKj) [158.94.208.175]:64816: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-31 01:07:58 dovecot_login authenticator failed for H=([125.17.215.121]) [27.123.92.202]:43252: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:07:16 dovecot_login authenticator failed for H=(nGZnIUW9Ys) [2.58.56.77]:55598: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:07:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:07:08 dovecot_login authenticator failed for H=(K4BLlRk0) [178.16.54.22]:54597: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:08:03 dovecot_login authenticator failed for H=(VxSs7H) [178.16.54.22]:54026: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:08:08 dovecot_login authenticator failed for H=(YtDccKP5Ts) [185.230.124.69]:58820: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:08:39 dovecot_login authenticator failed for H=(FZQSW4LS8v) [185.230.124.69]:59758: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:08:02 dovecot_login authenticator failed for H=(jw6e1y) [2.58.56.77]:50083: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:08:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:08:10 dovecot_login authenticator failed for H=(30sGDEW1) [158.94.208.175]:54004: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:08:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:08:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account astpkg@astlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:09:07 dovecot_login authenticator failed for H=(Vt1FHobW) [2.58.56.77]:55891: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.39.227.34
country_id: 1861060
description:
2026-01-31 01:09:59 dovecot_login authenticator failed for H=p430035-obmd01.tokyo.ocn.ne.jp [60.39.227.34]:48544: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:09:07 dovecot_login authenticator failed for H=(cjo8L35l9t) [178.16.54.22]:57911: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:09:15 dovecot_login authenticator failed for H=(wE7zmou2hK) [158.94.208.175]:60816: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.212.163.22
country_id: 2328926
domain: working.magsoft.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.71||T:APACHE||RA:102.212.163.22||TA:102.212.163.22||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:09:04 dovecot_login authenticator failed for H=(DeXffoszIg) [185.230.124.69]:63044: 535 Incorrect authentication data (set_id=astpkg@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:09:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:09:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:10:17 dovecot_login authenticator failed for H=(sFk56Ytm) [178.16.54.22]:58028: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:10:22 dovecot_login authenticator failed for H=(4Einf6pE) [158.94.208.175]:61039: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31  1:10:25 3133 [Warning] Aborted connection 3133 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2026-01-31 01:10:41 dovecot_login authenticator failed for H=([203.193.137.250]) [203.193.137.250]:55775: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:10:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-31 01:10:31 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:51955: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:10:16 dovecot_login authenticator failed for H=(cXME9Pi2) [185.230.124.69]:62493: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:10:15 dovecot_login authenticator failed for H=(B59HYL) [2.58.56.77]:63678: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77317988
name: IM360 WAF: Block access to quarantined files
abuser: 188.166.226.12
country_id: 1880251
domain: agsaintifik.com.my
description:
IM360 WAF: Block access to quarantined files||RSV:7.71||T:APACHE||MVN:REQUEST_URI||MV:/.quarantine/alfacgiapi/perl.alfa||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-31 01:11:06 dovecot_login authenticator failed for H=([122.184.143.81]) [182.95.47.2]:43504: 535 Incorrect authentication data (set_id=aziz)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.219.140
country_id: 3996063
domain: www.ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:11:04 dovecot_login authenticator failed for H=(m2Wbzs) [185.230.124.69]:65034: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-31 01:11:05 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br [187.126.105.42]:49309: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:11:23 dovecot_login authenticator failed for H=(mSTcSgo4) [2.58.56.77]:62850: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:11:01 dovecot_login authenticator failed for H=(Gf8hO7) [185.230.124.69]:59639: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:11:11 dovecot_login authenticator failed for H=(eO1J87Ezh) [178.16.54.22]:60889: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.83.159
country_id: 2017370
description:
2026-01-31 01:11:13 dovecot_login authenticator failed for H=(5x16x83x159.dynamic.spb.ertelecom.ru) [5.16.83.159]:52796: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:11:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:11:06 dovecot_login authenticator failed for H=(mjTeTvpnJ9) [158.94.208.175]:60145: 535 Incorrect authentication data (set_id=felioit)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 176.119.140.20
country_id: 2017370
domain: www.oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:oxboldc||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31  1:11:17 3199 [Warning] Aborted connection 3199 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:12:08 dovecot_login authenticator failed for H=(Uuc6XdHR8P) [185.230.124.69]:54530: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:12:14 dovecot_login authenticator failed for H=(Tzu5L9K1w) [158.94.208.175]:62360: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 95.217.176.173
country_id: 660013
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/about.php||SC:/home2/feliogroupcom/public_html/images/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:12:23 dovecot_login authenticator failed for H=(0GX6YdhLG) [178.16.54.22]:62267: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 01:12:25 H=([64.89.160.15]) [64.89.160.15]:56124 F=<essenas@outlook.com> rejected RCPT <sales@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:12:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:12:28 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:12:09 dovecot_login authenticator failed for H=(PPLi3pr6) [2.58.56.77]:53947: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:13:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:13:21 dovecot_login authenticator failed for H=(V9NpasQt) [178.16.54.22]:64413: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.129.89
country_id: 1861060
domain: mail.hishammuddin.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/cabecom/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:13:14 dovecot_login authenticator failed for H=(mwVaOYc) [2.58.56.77]:52577: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:13:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:13:11 dovecot_login authenticator failed for H=(YLb5yPew) [185.230.124.69]:58079: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:13:20 dovecot_login authenticator failed for H=(mGsFNeR) [158.94.208.175]:61903: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:14:05 dovecot_login authenticator failed for H=(WzYSN1Q) [158.94.208.175]:59034: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:14:10 dovecot_login authenticator failed for H=(pJ0t1kZ921) [185.230.124.69]:62410: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:14:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:14:03 dovecot_login authenticator failed for H=(yQuNp182e) [2.58.56.77]:60127: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: cloudhost.magsoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/cloudhostmagsoft/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:14:22 dovecot_login authenticator failed for H=(xFhafaV) [178.16.54.22]:64080: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:14:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:14:05 dovecot_login authenticator failed for H=(4ALdWrOZk) [185.230.124.69]:54450: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:15:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.161
country_id: 2750405
description:
2026-01-31  1:16:00 3727 [Warning] Aborted connection 3727 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.161' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:15:08 dovecot_login authenticator failed for H=(Lym7yGKC) [2.58.56.77]:58148: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:15:11 dovecot_login authenticator failed for H=(KodDxUA) [178.16.54.22]:58628: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-01-31 01:15:45 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:49988: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.223.150.246
country_id: 2963597
domain: cloudhost.magsoft.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/cloudhostmagsoft/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-31 01:15:54 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:43858: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:15:03 dovecot_login authenticator failed for H=(OhpnDpe1E) [158.94.208.175]:56246: 535 Incorrect authentication data (set_id=daniel@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:15:04 dovecot_login authenticator failed for H=(yo4tvM6) [185.230.124.69]:60384: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.185.18
country_id: 1269750
description:
2026-01-31 01:16:33 dovecot_login authenticator failed for H=([182.95.87.179]) [122.185.185.18]:54094: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.17.213.162
country_id: 1814991
description:
2026-01-31 01:16:47 dovecot_login authenticator failed for H=([111.17.213.162]) [111.17.213.162]:52909: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:17:00 dovecot_login authenticator failed for H=(jkswHHm) [185.230.124.69]:58127: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:16:06 dovecot_login authenticator failed for H=(bfNUSQ) [178.16.54.22]:60386: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:16:13 dovecot_login authenticator failed for H=(oQc7tN) [2.58.56.77]:61318: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:16:15 dovecot_login authenticator failed for H=(pN3rRcs) [185.230.124.69]:57216: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:16:02 dovecot_login authenticator failed for H=(w9JEGbAF) [158.94.208.175]:50119: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:16:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.206.142
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/DependencyInjection/AddAnnotatedClassesToCachePass.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:17:04 dovecot_login authenticator failed for H=(8soRtS) [158.94.208.175]:61936: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:17:08 dovecot_login authenticator failed for H=(gcJAwZLU) [185.230.124.69]:52840: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.77.115
country_id: 1269750
description:
2026-01-31 01:17:23 dovecot_login authenticator failed for H=([103.220.16.51]) [117.247.77.115]:60882: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.22.230.116
country_id: 587116
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/CacheClearer/Psr6CacheClearer.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:17:12 dovecot_login authenticator failed for H=(oPtWOgk8) [178.16.54.22]:51430: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:17:15 dovecot_login authenticator failed for H=(90o8BXH) [2.58.56.77]:51081: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.38
country_id: 1269750
description:
2026-01-31 01:17:41 dovecot_login authenticator failed for H=([203.147.89.38]) [203.147.89.38]:38576: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.93.62.202
country_id: 2017370
description:
2026-01-31 01:18:23 dovecot_login authenticator failed for H=80-93-62-202.vps-ptr.clients.spaceweb.ru [80.93.62.202]:38810: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-31 01:18:16 dovecot_login authenticator failed for H=([182.95.215.9]) [182.95.227.70]:43074: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:18:20 dovecot_login authenticator failed for H=(0Fe9NDD) [2.58.56.77]:54539: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:18:02 dovecot_login authenticator failed for H=(pp7Wv5) [158.94.208.175]:52560: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:18:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:18:10 dovecot_login authenticator failed for H=(BqfcxAg) [178.16.54.22]:62913: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:18:17 dovecot_login authenticator failed for H=(0r4YY33) [185.230.124.69]:50991: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:19:03 dovecot_login authenticator failed for H=(eLLhGpIIoq) [185.230.124.69]:61260: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-31 01:19:21 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:54874: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:19:46 dovecot_login authenticator failed for H=(Z18DFLG78X) [185.230.124.69]:52632: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:19:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:19:09 dovecot_login authenticator failed for H=(JVFBiMAi) [178.16.54.22]:60379: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.170
country_id: 6251999
description:
2026-01-31 01:19:57 dovecot_login authenticator failed for H=([207.134.139.173]) [207.134.139.170]:64423: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
country_id: 1814991
description:
2026-01-31 01:19:10 dovecot_login authenticator failed for H=([210.13.99.68]) [210.13.99.66]:3179: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:19:21 dovecot_login authenticator failed for H=(Sk0gHB) [2.58.56.77]:56064: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:19:02 dovecot_login authenticator failed for H=(v8OBw0n3) [158.94.208.175]:62133: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:20:08 dovecot_login authenticator failed for H=(y1SdBn) [158.94.208.175]:53527: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:20:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.147.32
country_id: 2017370
description:
2026-01-31 01:20:27 dovecot_login authenticator failed for H=(ip32-147-111-78.pppoe.ivanovo.stream.ru) [78.111.147.32]:60514: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.172.80.110
country_id: 1269750
domain: smartcable.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45503.smartcable.com.my||ServerName:smartcable.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8e0d6de3b3c62e1ea665b86e5136b301d956ac43||Title:0xd9db38be||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-31 01:20:18 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:44954: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-31 01:20:18 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:48718: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:20:10 dovecot_login authenticator failed for H=(SWHlqbq) [2.58.56.77]:56181: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:20:13 dovecot_login authenticator failed for H=(2OGKvSFR6N) [185.230.124.69]:61560: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-31 01:20:50 H=([45.144.212.41]) [45.144.212.41]:64714 F=<ash.zhang@ugslogistics.com> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from ugslogistics.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-01-31 01:21:33 +0800] info [cpaneld] 185.204.54.153 - mssa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:21:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:21:08 dovecot_login authenticator failed for H=(uH2rK1d1cA) [185.230.124.69]:50703: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:21:11 dovecot_login authenticator failed for H=(S3ep5B5A) [158.94.208.175]:50261: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:21:20 dovecot_login authenticator failed for H=(JcvljF4M8z) [2.58.56.77]:51440: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:21:07 dovecot_login authenticator failed for H=(r18Ejht3LF) [178.16.54.22]:50008: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:22:38 dovecot_login authenticator failed for H=(mHXlypzD) [158.94.208.175]:63053: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:22:50 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:22:02 dovecot_login authenticator failed for H=(xJm5hQB) [185.230.124.69]:62741: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:22:06 dovecot_login authenticator failed for H=(NIuZXjS) [2.58.56.77]:56428: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:22:12 dovecot_login authenticator failed for H=(vUBdDSPg) [178.16.54.22]:57656: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:22:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:22:54 dovecot_login authenticator failed for H=(VPzfXQpr0u) [185.230.124.69]:59540: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:23:11 dovecot_login authenticator failed for H=(ntPCLzj) [2.58.56.77]:55561: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:23:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.24.104
country_id: 1269750
domain: ajresorts.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/ajresortscom/public_html/wp-includes||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:23:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:23:21 dovecot_login authenticator failed for H=(TH6KSFkb) [185.230.124.69]:57586: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:23:10 dovecot_login authenticator failed for H=(IWKjWY) [158.94.208.175]:55600: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:23:24 dovecot_login authenticator failed for H=(YqEYG2) [178.16.54.22]:61680: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:24:02 dovecot_login authenticator failed for H=(pLyft9f7) [158.94.208.175]:55678: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:24:08 dovecot_login authenticator failed for H=(cnMj7GA) [185.230.124.69]:65414: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:24:04 dovecot_login authenticator failed for H=(iW37VISw) [2.58.56.77]:55517: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 01:24:18 dovecot_login authenticator failed for H=(nMop000eL) [193.26.115.228]:63531: 535 Incorrect authentication data (set_id=hafizi)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:24:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:24:31 dovecot_login authenticator failed for H=(XGfA8Lofv) [178.16.54.22]:57530: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-01-31 01:24:54 dovecot_login authenticator failed for H=([42.1.110.201]) [42.1.110.201]:46074: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:25:20 dovecot_login authenticator failed for H=(caotlNnv) [158.94.208.175]:49636: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:25:17 dovecot_login authenticator failed for H=(oS5Z5kbpAn) [2.58.56.77]:60755: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:25:18 dovecot_login authenticator failed for H=(yqhOXji) [185.230.124.69]:57781: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:25:43 dovecot_login authenticator failed for H=(Li8XZp2jh) [185.230.124.69]:49585: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.228.165
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=794941 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:25:03 dovecot_login authenticator failed for H=(PX62K7SK) [178.16.54.22]:55456: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.28.253.144
country_id: 690791
description:
2026-01-31 01:25:08 dovecot_login authenticator failed for H=(undefined.sevstar.net) [31.28.253.144]:34214: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:25:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:26:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.129.89
country_id: 1861060
domain: imax.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/imaxcom/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:26:20 dovecot_login authenticator failed for H=(f0PbNNkV) [158.94.208.175]:64698: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:26:56 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:26:06 dovecot_login authenticator failed for H=(Ui9xvME) [2.58.56.77]:63000: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:26:13 dovecot_login authenticator failed for H=(HWkvuo) [178.16.54.22]:57827: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.158.148
country_id: 1814991
description:
2026-01-31 01:27:01 dovecot_login authenticator failed for H=([60.166.158.148]) [60.166.158.148]:60345: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.56.144.131
country_id: 1269750
domain: solidfence.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:28724.solidfence.com.my||ServerName:solidfence.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7c2ca50d2f5ed3ae6493f3f5412e2cb7d3e95fac||Title:0x09d29b0a||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/finder/Tests/Fixtures/A/a.dat||User:visoftcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:26:08 dovecot_login authenticator failed for H=(86LFzP) [185.230.124.69]:63583: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:27:23 dovecot_login authenticator failed for H=(IwoH3RHWdS) [2.58.56.77]:63419: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-01-31 01:27:24 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:52820: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:27:06 dovecot_login authenticator failed for H=(7jPJXkSl8) [158.94.208.175]:51266: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:27:19 dovecot_login authenticator failed for H=(MNhiy6) [185.230.124.69]:51562: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:27:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:27:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.39
country_id: 3703430
description:
2026-01-31 01:27:54 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.39]:38425: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:27:14 dovecot_login authenticator failed for H=(D8Gay4vQ) [178.16.54.22]:53704: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:28:32 dovecot_login authenticator failed for H=(TYtNE4x7) [185.230.124.69]:49372: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.210
country_id: 99237
description:
2026-01-31 01:28:43 dovecot_plain authenticator failed for H=(argenepa) [65.20.191.210]:35844: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:28:02 dovecot_login authenticator failed for H=(4fxR2pt) [158.94.208.175]:55057: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:28:03 dovecot_login authenticator failed for H=(Ejn2VVlXi0) [178.16.54.22]:55744: 535 Incorrect authentication data (set_id=rosliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:28:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:28:07 dovecot_login authenticator failed for H=(J5RVGFeQj) [185.230.124.69]:49530: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:28:11 dovecot_login authenticator failed for H=(6b4zG0V) [2.58.56.77]:53478: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.212.54.174
country_id: 614540
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/afraid/10/112/1031803 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:29:16 dovecot_login authenticator failed for H=(Rm63Dn9Lc) [185.230.124.69]:50831: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.9
country_id: 6252001
domain: www.task.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/symfony/translation/Loader/schema/dic/xliff-core/xliff-core-2.0.xsd||User:visoftcom||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:29:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 45.142.99.14
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 14; RMX3521 Build/UKQ1.230924.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/124.0.6367.123 Mobile Safari/537.36 trill_340506 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/34.5.6 ByteLocale/id-ID ByteFullLocale/id-ID Region/ID AppId/1180 Spark/1.5.4.10-bugfix AppVersion/34.5.6 BytedanceWebview/d8a21c6||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:29:04 dovecot_login authenticator failed for H=(VmM3JEecJy) [158.94.208.175]:55742: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:29:07 dovecot_login authenticator failed for H=(H7TffV) [178.16.54.22]:61050: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:29:22 dovecot_login authenticator failed for H=(QSq8b10gL) [2.58.56.77]:64059: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:30:14 dovecot_login authenticator failed for H=(vc1hLVkO) [158.94.208.175]:50372: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:30:09 dovecot_login authenticator failed for H=(sgu684h) [2.58.56.77]:55848: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:30:44 dovecot_login authenticator failed for H=(QxMaisTUf) [178.16.54.22]:57398: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:30:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:30:13 dovecot_login authenticator failed for H=(5ozQsU7X) [185.230.124.69]:61662: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:31:24 dovecot_login authenticator failed for H=(9I8mPXDU5) [185.230.124.69]:57729: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:31:01 dovecot_login authenticator failed for H=(S4mOUMKcN3) [178.16.54.22]:54025: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:31:22 dovecot_login authenticator failed for H=(7t8Zas9) [2.58.56.77]:53893: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:31:06 dovecot_login authenticator failed for H=(ZUNXhPiKZ) [158.94.208.175]:57168: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:31:05 dovecot_login authenticator failed for H=(5kcCb4ct9a) [185.230.124.69]:63481: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:31:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:32:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:32:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account boolan@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:32:24 dovecot_login authenticator failed for H=(sSY6S5p) [178.16.54.22]:53563: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:32:02 dovecot_login authenticator failed for H=(b71owgjHE) [158.94.208.175]:55296: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:32:05 dovecot_login authenticator failed for H=(4iwMeGs7L) [2.58.56.77]:59865: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:32:09 dovecot_login authenticator failed for H=(dJ8zLS) [185.230.124.69]:63651: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:33:10 dovecot_login authenticator failed for H=(a1LHBSi) [158.94.208.175]:60418: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:33:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:33:15 dovecot_login authenticator failed for H=(FTYUxI) [2.58.56.77]:58491: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:33:01 dovecot_login authenticator failed for H=(qXpwzpvj5R) [185.230.124.69]:56608: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:33:23 dovecot_login authenticator failed for H=(sIOf7xnF) [178.16.54.22]:64777: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:34:21 dovecot_login authenticator failed for H=(9rOePpxT) [185.230.124.69]:49519: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-31 01:34:24 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:57490: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:34:35 dovecot_login authenticator failed for H=(HotIqQ) [178.16.54.22]:55729: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:34:16 dovecot_login authenticator failed for H=(Q7YlasG) [2.58.56.77]:55972: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 01:34:52 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:6094: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:34:48 dovecot_login authenticator failed for H=(KVz2j0jxZ) [158.94.208.175]:62926: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:34:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.113.253
country_id: 2510769
description:
2026-01-31 01:34:16 dovecot_login authenticator failed for H=(253.pool90-160-113.dynamic.orange.es) [90.160.113.253]:60763: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:34:20 dovecot_login authenticator failed for H=(00Y47d) [185.230.124.69]:60645: 535 Incorrect authentication data (set_id=boolan@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:35:36 dovecot_login authenticator failed for H=(Jl9fRZNro) [178.16.54.138]:61783: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:35:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 01:35:05 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:61843: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:35:09 dovecot_login authenticator failed for H=(4Yge2TMN) [178.16.54.22]:50329: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 174.138.27.41
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:agpcorg||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:35:58 dovecot_login authenticator failed for H=(gQGKHZZ) [158.94.208.175]:64420: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:35:13 dovecot_login authenticator failed for H=(0jf0RwlJ) [185.230.124.69]:57577: 535 Incorrect authentication data (set_id=boolan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:35:02 dovecot_login authenticator failed for H=(7ZYucyRE) [2.58.56.77]:59120: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 174.138.27.41
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:agpcorg||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:36:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:36:07 dovecot_login authenticator failed for H=(n89Qra4pDQ) [2.58.56.77]:59619: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:36:57 dovecot_login authenticator failed for H=(pOtLQjkO0) [185.230.124.69]:60121: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:36:04 dovecot_login authenticator failed for H=(ZoqpIacX) [185.230.124.69]:49397: 535 Incorrect authentication data (set_id=boolan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:36:08 dovecot_login authenticator failed for H=(9H1nX6x6Jg) [178.16.54.22]:58668: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.62.173.90
country_id: 1814991
description:
2026-01-31 01:36:12 dovecot_login authenticator failed for H=([111.62.173.90]) [111.62.173.90]:59542: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-31 01:36:28 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:17876: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 2.58.56.77
country_id: 2750405
description:
Jan 31 01:36:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account mustapa@astlog.com.my has been locked for the attacker IP 2.58.56.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:36:06 dovecot_login authenticator failed for H=(k4Qgrri) [158.94.208.175]:58738: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:36:22 dovecot_login authenticator failed for H=(62NYlTW) [178.16.54.138]:58527: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:37:06 dovecot_login authenticator failed for H=(7bauC1YRF) [158.94.208.175]:58192: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:37:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:37:02 dovecot_login authenticator failed for H=(ndoPWr) [185.230.124.69]:51918: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:37:05 dovecot_login authenticator failed for H=(68qMRoX3Ag) [178.16.54.22]:62130: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 212.107.27.168
country_id: 2921044
domain: www.oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.bak||User:oxboldc||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.77
country_id: 2750405
description:
2026-01-31 01:37:13 dovecot_login authenticator failed for H=(mQEvej67o) [2.58.56.77]:57656: 535 Incorrect authentication data (set_id=mustapa@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:37:29 dovecot_login authenticator failed for H=(oBJ49L7O3V) [178.16.54.138]:59103: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:38:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:38:01 dovecot_login authenticator failed for H=(ACmYi7) [178.16.54.138]:56789: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:38:07 dovecot_login authenticator failed for H=(WMFYgpJu0) [178.16.54.22]:52645: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:38:08 dovecot_login authenticator failed for H=(Nq0laC) [158.94.208.175]:63598: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:38:12 dovecot_login authenticator failed for H=(PWhjXd6bda) [185.230.124.69]:50960: 535 Incorrect authentication data (set_id=boolan)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:39:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:39:31 dovecot_login authenticator failed for H=(QipHXN) [178.16.54.22]:55755: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.95.177.220
country_id: 6252001
domain: www.dsc-expat.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.71.22.62
country_id: 6252001
description:
2026-01-31  1:39:09 4535 [Warning] Aborted connection 4535 to db: 'unconnected' user: 'unauthenticated' host: '167.71.22.62' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.245.240.239
country_id: 6252001
description:
2026-01-31  1:39:10 4536 [Warning] Aborted connection 4536 to db: 'unconnected' user: 'unauthenticated' host: '157.245.240.239' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:39:21 dovecot_login authenticator failed for H=(jkEWKE3S) [185.230.124.69]:52364: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:39:48 dovecot_login authenticator failed for H=(nUXL33JI1) [158.94.208.175]:51383: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:39:50 dovecot_login authenticator failed for H=(AQlI0H6w) [178.16.54.138]:58677: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-31 01:39:01 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:56042: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-01-31 01:39:08 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:41870: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:39:07 dovecot_login authenticator failed for H=(wnHtlPoC6) [185.230.124.69]:61893: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:40:04 dovecot_login authenticator failed for H=(J2eQ4L1s) [178.16.54.22]:54551: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:40:06 dovecot_login authenticator failed for H=(0YbTZ8kcH0) [185.230.124.69]:49733: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:40:23 dovecot_login authenticator failed for H=(zE7yZGKW) [178.16.54.138]:54280: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:40:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:40:22 dovecot_login authenticator failed for H=(7fS2Ne) [158.94.208.175]:54741: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-31 01:40:52 dovecot_login authenticator failed for H=(nsg-corporate-203.184.185.122.airtel.in) [152.52.244.106]:37820: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:41:23 dovecot_login authenticator failed for H=(JKt5JkFm) [185.230.124.69]:64324: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:41:29 dovecot_login authenticator failed for H=(oz32MF) [178.16.54.138]:58571: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:41:45 dovecot_login authenticator failed for H=(7NIWJPuL) [158.94.208.175]:51034: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2026-01-31 01:41:04 dovecot_login authenticator failed for H=([220.122.115.9]) [220.122.115.9]:57164: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-01-31 01:41:07 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:37860: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2026-01-31 01:41:17 dovecot_login authenticator failed for H=([178.178.222.50]) [178.178.222.50]:49424: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:41:30 dovecot_login authenticator failed for H=(aKsDbH7eTH) [178.16.54.22]:50961: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-31 01:41:46 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:37266: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.195
country_id: 6252001
description:
Jan 31 01:42:49 sv3 pure-ftpd[3634005]: (?@198.235.24.195) [INFO] New connection from 198.235.24.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:42:07 dovecot_login authenticator failed for H=(ZWW4C1yT) [178.16.54.138]:58803: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:42:15 dovecot_login authenticator failed for H=(14O6zXi) [158.94.208.175]:57741: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:41:49 dovecot_login authenticator failed for H=(B1OAJvyZug) [185.230.124.69]:60950: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:42:05 dovecot_login authenticator failed for H=(jDuowG) [178.16.54.22]:49728: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.9.218
country_id: 2017370
description:
2026-01-31 01:41:58 dovecot_login authenticator failed for H=([213.234.9.218]) [213.234.9.218]:49864: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:43:21 dovecot_login authenticator failed for H=(WnlDte) [178.16.54.22]:52300: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2026-01-31 01:43:41 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:57928: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:43:54 dovecot_login authenticator failed for H=(QyQZwkI) [178.16.54.22]:63414: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:43:25 dovecot_login authenticator failed for H=(72apwbU) [178.16.54.138]:62527: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:43:03 dovecot_login authenticator failed for H=(OLQDM8UcOs) [185.230.124.69]:65395: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:43:06 dovecot_login authenticator failed for H=(3uSdUf) [158.94.208.175]:57491: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 01:43:20 H=([64.89.160.15]) [64.89.160.15]:58212 F=<drdavid00r5@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-31 01:43:48 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.181]:39486: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:44:03 dovecot_login authenticator failed for H=(be7lXEqa3D) [185.230.124.69]:51356: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-31 01:44:14 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:44:41 dovecot_login authenticator failed for H=(WHn2qHk) [178.16.54.138]:53677: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.173.121.100
country_id: 1814991
description:
2026-01-31 01:44:04 dovecot_login authenticator failed for H=([180.173.121.100]) [180.173.121.100]:20176: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.16.40.3
country_id: 1814991
description:
2026-01-31 01:44:20 dovecot_login authenticator failed for H=([110.16.40.3]) [110.16.40.3]:23508: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:44:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:44:51 dovecot_login authenticator failed for H=(PB3oRS7) [158.94.208.175]:62987: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:44:25 dovecot_login authenticator failed for H=(S3IX8FE) [178.16.54.22]:65116: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:45:09 dovecot_login authenticator failed for H=(WPCeuNiKl) [178.16.54.22]:62173: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:45:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:45:23 dovecot_login authenticator failed for H=(HBerB2Lp) [185.230.124.69]:51120: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:45:18 dovecot_login authenticator failed for H=(1MLyKKjJ) [158.94.208.175]:58375: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-31 01:46:00 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:54026: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:46:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:46:14 dovecot_login authenticator failed for H=(EITLomQ) [185.230.124.69]:62131: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:46:41 dovecot_login authenticator failed for H=(keD75z) [185.230.124.69]:55730: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-31 01:46:47 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:59854: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:46:01 dovecot_login authenticator failed for H=(08LxhJG3) [178.16.54.138]:53701: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:46:07 dovecot_login authenticator failed for H=(0lsLOU7f) [158.94.208.175]:64308: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:46:12 dovecot_login authenticator failed for H=(63JRWE) [178.16.54.22]:63892: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:47:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-31 01:47:33 dovecot_login authenticator failed for H=([125.17.236.223]) [125.17.233.246]:50534: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:47:27 dovecot_login authenticator failed for H=(n0YfKDc) [158.94.208.175]:64470: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:47:30 dovecot_login authenticator failed for H=(I4ovUcGsa) [178.16.54.22]:52350: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:47:07 dovecot_login authenticator failed for H=(9SV6KGR) [185.230.124.69]:64820: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.42.45.27
country_id: 2921044
description:
2026-01-31 01:47:13 dovecot_plain authenticator failed for H=purple-lemur-47989.zap.cloud [92.42.45.27]:61116: 535 Incorrect authentication data (set_id=jesslim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:47:12 dovecot_login authenticator failed for H=(Sgu3C1) [178.16.54.138]:54157: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-01-31 01:47:15 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:41642: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:48:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.38.68.223
country_id: 1269750
domain: stillman.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20346.stillman.my||ServerName:stillman.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c51c866578208d4ec766aacba368494449112903||Title:0xf8668b1f||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:48:20 dovecot_login authenticator failed for H=(RpV7xPRgi2) [185.230.124.69]:60065: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-31 01:48:34 dovecot_login authenticator failed for H=(nsg-corporate-203.184.185.122.airtel.in) [152.52.244.106]:52558: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.143
country_id: 3041565
description:
2026-01-31 01:48:37 dovecot_login authenticator failed for H=(ADMIN) [173.239.217.143]:52927: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:48:46 dovecot_login authenticator failed for H=(fR0mkVq1) [178.16.54.138]:63986: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 01:48:14 dovecot_login authenticator failed for H=([122.186.255.50]) [122.186.255.50]:48646: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:48:21 dovecot_login authenticator failed for H=(FIYIGGB2S) [158.94.208.175]:63504: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:48:06 dovecot_login authenticator failed for H=(4JS6C73) [178.16.54.22]:62977: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.101
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62821516780656 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:49:13 dovecot_login authenticator failed for H=(0WPvX3) [178.16.54.22]:52187: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:49:13 dovecot_login authenticator failed for H=(mahCZFD) [158.94.208.175]:57744: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:49:37 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:49:39 dovecot_login authenticator failed for H=(GMyNOeB) [185.230.124.69]:49505: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 01:49:40 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:4007: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.242.5.231
country_id: 3996063
domain: stillman.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20299.stillman.my||ServerName:stillman.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c4cd365197397e570328dc98d0d4fd7c178674d6||Title:0x3ee3f3e2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:49:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-01-31 01:49:19 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:36986: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:49:08 dovecot_login authenticator failed for H=(U4gRbX) [185.230.124.69]:60472: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:50:14 dovecot_login authenticator failed for H=(esNHfOKb4q) [178.16.54.22]:65368: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:50:19 dovecot_login authenticator failed for H=(6UbH1GI) [178.16.54.138]:50285: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:50:21 dovecot_login authenticator failed for H=(wYZa7M7RX5) [185.230.124.69]:49953: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:50:07 dovecot_login authenticator failed for H=(lmpruyyp) [158.94.208.175]:59430: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:50:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:50:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:51:02 dovecot_login authenticator failed for H=(QwJkKBJelr) [158.94.208.175]:50923: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:51:12 dovecot_login authenticator failed for H=(o6zJEpgpTz) [185.230.124.69]:51822: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2026-01-31 01:51:41 dovecot_login authenticator failed for H=([125.17.182.121]) [182.95.224.62]:52902: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:51:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:51:42 dovecot_login authenticator failed for H=(xwcrwbqnn) [178.16.54.138]:50811: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:51:13 dovecot_login authenticator failed for H=(DD6MURtw) [178.16.54.22]:60213: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:51:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.63.207.166
country_id: 3175395
description:
2026-01-31 01:51:58 dovecot_login authenticator failed for H=([151.63.207.166]) [151.63.207.166]:44010: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:52:02 dovecot_login authenticator failed for H=(CfEPIf2) [185.230.124.69]:50335: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:52:20 dovecot_login authenticator failed for H=(YD9RCKIc0P) [158.94.208.175]:61736: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.183.114.175
country_id: 3469034
description:
2026-01-31 01:52:38 dovecot_login authenticator failed for H=([179.183.114.175]) [179.183.114.175]:60824: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:52:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.118
country_id: 1149361
description:
2026-01-31 01:52:23 dovecot_login authenticator failed for H=([149.54.62.118]) [149.54.62.118]:43530: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:52:30 dovecot_login authenticator failed for H=(bWwz2BEeo) [185.230.124.69]:61702: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:52:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:52:11 dovecot_login authenticator failed for H=(fNx7frhF6) [178.16.54.22]:58546: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:53:14 dovecot_login authenticator failed for H=(GCMfWPCh) [178.16.54.138]:63591: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:53:08 dovecot_login authenticator failed for H=(O2mqvjrvzH) [178.16.54.22]:64222: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:53:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:53:13 dovecot_login authenticator failed for H=(IAyinvWd) [158.94.208.175]:60954: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:53:42 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:53:11 dovecot_login authenticator failed for H=(IQhBaMRFgF) [185.230.124.69]:54416: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:54:09 dovecot_login authenticator failed for H=(MWMRJgq) [158.94.208.175]:64831: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.111.106
country_id: 1835841
description:
2026-01-31 01:54:28 dovecot_login authenticator failed for H=([59.8.111.106]) [59.8.111.106]:51364: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.71.41
country_id: 6252001
description:
2026-01-31 01:54:37 dovecot_login authenticator failed for H=([209.23.71.41]) [209.23.71.41]:50772: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.0.202
country_id: 2017370
description:
2026-01-31 01:54:03 dovecot_login authenticator failed for H=([83.239.0.202]) [83.239.0.202]:45732: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:54:04 dovecot_login authenticator failed for H=(jAj6z3Kgb8) [178.16.54.22]:52855: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 01:54:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:54:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:54:10 dovecot_login authenticator failed for H=(Vgm6qBtjj) [185.230.124.69]:61893: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 81.22.44.50
country_id: 2017370
domain: www.oxbold.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:7.71||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.73.228.90
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=234981 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.22.44.50
country_id: 2017370
domain: www.oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:oxboldc||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:55:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:55:03 dovecot_login authenticator failed for H=(vTAxzzh) [158.94.208.175]:55926: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:55:23 dovecot_login authenticator failed for H=(krgDdplhZ7) [185.230.124.69]:53194: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:55:13 dovecot_login authenticator failed for H=(zJy6wIGo) [178.16.54.138]:57324: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:55:07 dovecot_login authenticator failed for H=(cCN2pq) [178.16.54.22]:57323: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:55:25 dovecot_login authenticator failed for H=(naewDY8Pi) [185.230.124.69]:49863: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:56:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:56:11 dovecot_login authenticator failed for H=(GrS3uEEcv) [185.230.124.69]:50863: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:56:17 dovecot_login authenticator failed for H=(C5jdIlYWuU) [178.16.54.138]:57531: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:56:38 dovecot_login authenticator failed for H=(MT3Gsl) [178.16.54.22]:62619: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:56:24 dovecot_login authenticator failed for H=(xvNhsK1) [158.94.208.175]:53983: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:57:14 dovecot_login authenticator failed for H=(HxcIFS) [158.94.208.175]:65254: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:57:33 dovecot_login authenticator failed for H=(OQKu01Lq) [178.16.54.22]:54769: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 01:57:42 H=(localhost.localdomain) [78.153.140.207]:56988 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:57:02 dovecot_login authenticator failed for H=(Sw1uhH) [185.230.124.69]:64000: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:57:28 dovecot_login authenticator failed for H=(tHG6p52) [178.16.54.138]:50826: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:57:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.47.138.157
country_id: 6252001
description:
2026-01-31 01:57:15 dovecot_login authenticator failed for H=(136-47-138-157.googlefiber.net) [136.47.138.157]:53466: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.235.145.22
country_id: 2017370
description:
2026-01-31 01:57:23 dovecot_login authenticator failed for H=(188x235x145x22.static-business.saratov.ertelecom.ru) [188.235.145.22]:56586: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:58:02 dovecot_login authenticator failed for H=(xWUmPvQ) [178.16.54.138]:64792: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:58:06 dovecot_login authenticator failed for H=(DId1iHwe) [158.94.208.175]:55004: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:58:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:58:19 dovecot_login authenticator failed for H=(k4EmDGJ1BT) [185.230.124.69]:63208: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:58:22 dovecot_login authenticator failed for H=(oKUziQMG0) [185.230.124.69]:50264: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 01:59:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 01:59:23 dovecot_login authenticator failed for H=(XjaI5fzR01) [158.94.208.175]:58773: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 01:59:37 dovecot_login authenticator failed for H=(pihTJcj) [178.16.54.22]:57603: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 01:59:04 dovecot_login authenticator failed for H=(tDEOGNhXa) [185.230.124.69]:59681: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 01:59:10 dovecot_login authenticator failed for H=(9NqyrRJ7P) [178.16.54.138]:59848: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-01-31 01:59:51 dovecot_login authenticator failed for H=([65.20.204.88]) [65.20.204.88]:35617: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:00:17 dovecot_login authenticator failed for H=(S8APEQJg) [178.16.54.138]:51106: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:00:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.42.190.241
country_id: 6252001
description:
2026-01-31 02:00:08 dovecot_login authenticator failed for H=host241.sub-63-42-190.myvzw.com [63.42.190.241]:40728: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:00:07 dovecot_login authenticator failed for H=(MahFahTR) [178.16.54.22]:58145: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:00:43 dovecot_login authenticator failed for H=(glcO1K) [185.230.124.69]:49238: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:00:00 dovecot_login authenticator failed for H=(PHugUd) [185.230.124.69]:64702: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-31  2:00:13 5297 [Warning] Aborted connection 5297 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:00:21 dovecot_login authenticator failed for H=(RkT3T7ot) [158.94.208.175]:54619: 535 Incorrect authentication data (set_id=felioit)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:01:09 dovecot_login authenticator failed for H=(T490pSpYD) [185.230.124.69]:61217: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:01:26 dovecot_login authenticator failed for H=(VUJID4tkRr) [178.16.54.138]:58011: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.186
country_id: 2750405
description:
2026-01-31  2:01:21 5321 [Warning] Aborted connection 5321 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.186' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:01:12 dovecot_login authenticator failed for H=(WmqTvDFMC0) [178.16.54.22]:57420: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:01:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:01:14 dovecot_login authenticator failed for H=(CfWvsjZmB) [158.94.208.175]:57611: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.55.237.165
country_id: 1562822
description:
2026-01-31 02:01:01 dovecot_login authenticator failed for H=([1.55.237.165]) [1.55.237.165]:57952: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:02:01 dovecot_login authenticator failed for H=(TnzGRh8SM8) [178.16.54.138]:58812: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:02:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:02:02 dovecot_login authenticator failed for H=(wxkzDCJgn6) [185.230.124.69]:55994: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:02:08 dovecot_login authenticator failed for H=(2QI4rER) [158.94.208.175]:57975: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:02:27 dovecot_login authenticator failed for H=(ckQAjh3o) [185.230.124.69]:64621: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:03:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment@tujusetia.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:03:11 dovecot_login authenticator failed for H=(8cDpuHbo) [178.16.54.138]:63459: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:03:51 dovecot_login authenticator failed for H=(hk22pX) [158.94.208.175]:60431: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.152.33.21
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=7&sub=42 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.63.234.164
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=5044 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:03:08 dovecot_login authenticator failed for H=(rdk8XiGqfJ) [185.230.124.69]:58063: 535 Incorrect authentication data (set_id=recruitment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-01-31 02:03:11 dovecot_login authenticator failed for H=([114.202.80.152]) [114.202.80.152]:39514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.146.93.14
country_id: 1668284
description:
2026-01-31 02:03:02 dovecot_login authenticator failed for H=(122-146-93-14.adsl.static.sparqnet.net) [122.146.93.14]:38716: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:03:03 dovecot_login authenticator failed for H=(5ofXbk3yp) [178.16.54.22]:49532: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:04:18 dovecot_login authenticator failed for H=(xE7mMoO3) [178.16.54.22]:62998: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:04:23 dovecot_login authenticator failed for H=(qslXwOy5Bd) [158.94.208.175]:65317: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:04:24 dovecot_login authenticator failed for H=(Q4kKzJG) [178.16.54.138]:60522: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:04:26 dovecot_login authenticator failed for H=(SfmASfDA) [185.230.124.69]:64631: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:04:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:04:10 dovecot_login authenticator failed for H=(AiWJIy) [185.230.124.69]:50466: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:05:12 dovecot_login authenticator failed for H=(FooXdG04) [178.16.54.22]:52911: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:05:16 dovecot_login authenticator failed for H=(3j0LkqMY5B) [158.94.208.175]:50991: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:05:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:05:11 dovecot_login authenticator failed for H=(acP9RJevJ3) [185.230.124.69]:51800: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-31 02:05:30 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (garnable) [73.196.144.25]:40692: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.146
country_id: 2921044
description:
2026-01-31 02:05:53 dovecot_login authenticator failed for H=(ADMIN) [212.102.57.146]:25106: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:05:58 dovecot_login authenticator failed for H=(w2JD9yIQ) [185.230.124.69]:65460: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:05:27 dovecot_login authenticator failed for H=(b8qGQX82) [178.16.54.138]:64419: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-01-31 02:06:08 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:5790: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:06:03 dovecot_login authenticator failed for H=(hMENc11HF) [185.230.124.69]:63203: 535 Incorrect authentication data (set_id=celine@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-31 02:06:20 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:52376: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:06:12 dovecot_login authenticator failed for H=(EQU2Fw5) [158.94.208.175]:58678: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.53.130.4
country_id: 1814991
description:
2026-01-31 02:06:25 dovecot_login authenticator failed for H=([116.53.130.4]) [116.53.130.4]:34622: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2026-01-31 02:06:40 dovecot_login authenticator failed for H=([49.124.154.172]) [49.124.154.172]:58716: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:06:01 dovecot_login authenticator failed for H=(YFDgjv) [178.16.54.138]:60192: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 02:06:15 H=(localhost.localdomain) [78.153.140.207]:60080 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:06:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:07:09 dovecot_login authenticator failed for H=(EQonioWX) [185.230.124.69]:60911: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-31 02:07:09 dovecot_login authenticator failed for H=(BncntKd) [178.16.54.138]:55624: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:07:18 dovecot_login authenticator failed for H=(dD20T8) [185.230.124.69]:51819: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 02:07:48 dovecot_login authenticator failed for H=(9cyKfV1cUZ) [178.16.54.22]:57429: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:07:08 dovecot_login authenticator failed for H=(ueyRxbA) [158.94.208.175]:55594: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:07:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine@ktlog.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:08:03 dovecot_login authenticator failed for H=(96oVuzRFDR) [185.230.124.69]:51828: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:08:13 dovecot_login authenticator failed for H=(gJAz3kKDSy) [158.94.208.175]:56185: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.34.183
country_id: 2802361
description:
Jan 31 02:08:22 sv3 pure-ftpd[3650685]: (?@34.76.34.183) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:08:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:08:11 H=([64.89.160.15]) [64.89.160.15]:62889 F=<drdavid00r5@outlook.com> rejected RCPT <janice@smartcable.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:09:26 dovecot_login authenticator failed for H=(sV7jfkvtg) [158.94.208.175]:59276: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.189.155
country_id: 3996063
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=185808 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:09:01 dovecot_login authenticator failed for H=(Wo7aWf4) [185.230.124.69]:51929: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:09:02 dovecot_login authenticator failed for H=(kpill2BBf) [185.230.124.69]:56667: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:09:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:10:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:10:06 dovecot_login authenticator failed for H=(WkKbDq2kF) [185.230.124.69]:65233: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.52.238.9
country_id: 2802361
description:
Jan 31 02:10:16 sv3 pure-ftpd[3651927]: (?@34.52.238.9) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:10:23 dovecot_login authenticator failed for H=(OK0APmn0) [185.230.124.69]:56969: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:11:09 dovecot_login authenticator failed for H=(CuLxFFjqa) [185.230.124.69]:50165: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:11:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:11:11 dovecot_login authenticator failed for H=(vMu96QGM) [158.94.208.175]:55008: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:11:53 dovecot_login authenticator failed for H=(tqER6MFxCO) [185.230.124.69]:52725: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.24.238
country_id: 798544
domain: old.nexuscollection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/var/www/html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.193.187
country_id: 1814991
description:
2026-01-31 02:12:39 dovecot_login authenticator failed for H=([59.46.193.187]) [59.46.193.187]:59469: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:12:04 dovecot_login authenticator failed for H=(Xd2coJWHZz) [185.230.124.69]:58268: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:12:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:12:28 dovecot_login authenticator failed for H=(DvNk2pNJ) [158.94.208.175]:63816: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:13:03 dovecot_login authenticator failed for H=(7qYYxbjev) [185.230.124.69]:52117: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:13:20 dovecot_login authenticator failed for H=(qSpAdqC9) [158.94.208.175]:54428: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 02:13:01 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:18744: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-31 02:13:09 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:55940: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-31 02:13:25 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:53195: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:13:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.104.194.23
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/MockExceptionHandler.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:13:26 dovecot_login authenticator failed for H=(tUwxbSSTq) [185.230.124.69]:56689: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:14:05 dovecot_login authenticator failed for H=(rWTvp0Ea8p) [185.230.124.69]:59024: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:14:13 dovecot_login authenticator failed for H=(qKbc9F) [158.94.208.175]:64149: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:14:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.142
country_id: 2186224
description:
2026-01-31 02:14:37 dovecot_login authenticator failed for H=([121.73.168.142]) [121.73.168.142]:41278: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.81.124.38
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22681514863685 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-31 02:14:52 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:39531: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:14:54 dovecot_login authenticator failed for H=(GF1bevHT) [185.230.124.69]:62202: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:15:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard@kendek.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2026-01-31 02:15:35 dovecot_login authenticator failed for H=([109.207.33.248]) [109.207.33.248]:33773: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:15:08 dovecot_login authenticator failed for H=(dGDNSS0W2O) [185.230.124.69]:57652: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:15:10 H=([64.89.160.15]) [64.89.160.15]:60460 F=<essenas@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-31 02:15:23 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:36687: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:15:07 dovecot_login authenticator failed for H=(JxyMCBC) [158.94.208.175]:59110: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:16:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:16:51 dovecot_login authenticator failed for H=(S60jaP) [158.94.208.175]:61970: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:16:01 dovecot_login authenticator failed for H=(WErqO404) [185.230.124.69]:54462: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:16:13 dovecot_login authenticator failed for H=(dr3SZt) [185.230.124.69]:55243: 535 Incorrect authentication data (set_id=celine)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.49.254.255
country_id: 1269750
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10306.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:befba933f20fb4da32a96868267a6d904eee170b||Title:0xb23a1231||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 02:16:49 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit@feliogroup.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-01-31 02:17:57 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:36446: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:17:06 dovecot_login authenticator failed for H=(oEzIYc) [185.230.124.69]:64671: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 02:17:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit@feliogroup.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:17:18 dovecot_login authenticator failed for H=(YdYSkRl) [158.94.208.175]:51085: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:17:44 dovecot_login authenticator failed for H=(1zJrP0q0ND) [185.230.124.69]:64434: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2026-01-31 02:17:50 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:41897: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:17:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
country_id: 1814991
description:
2026-01-31 02:17:40 dovecot_login authenticator failed for H=([59.34.17.130]) [59.34.17.130]:43557: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 02:18:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit@feliogroup.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:18:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2026-01-31 02:18:10 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:59600: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:18:13 dovecot_login authenticator failed for H=(rswiTwB) [158.94.208.175]:65529: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:18:44 dovecot_login authenticator failed for H=(DuGGThIltp) [185.230.124.69]:65398: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:18:03 dovecot_login authenticator failed for H=(BoDOzje) [185.230.124.69]:49595: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-31 02:18:26 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:57226: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-31 02:18:17 dovecot_login authenticator failed for H=([182.95.178.206]) [182.95.178.206]:49464: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:19:06 dovecot_login authenticator failed for H=(FGo4E2dZ) [185.230.124.69]:63493: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:19:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account recruitment has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:19:58 dovecot_login authenticator failed for H=(mTBJ75qNA4) [185.230.124.69]:63664: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:20:42 dovecot_login authenticator failed for H=(ElJChqG) [45.94.31.131]:56551: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 31 02:20:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account felioit@feliogroup.com.my has been locked for the attacker IP 158.94.208.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:20:04 dovecot_login authenticator failed for H=(WboEzBMRn) [158.94.208.175]:57942: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:20:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:20:17 dovecot_login authenticator failed for H=(XAeAGYUt) [185.230.124.69]:57684: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-01-31 02:21:22 dovecot_login authenticator failed for H=(cm-84.210.219.80.get.no) [84.210.219.80]:38600: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:21:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-31 02:21:27 dovecot_login authenticator failed for H=(5aaYGm8) [158.94.208.175]:54254: 535 Incorrect authentication data (set_id=felioit@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:21:03 dovecot_login authenticator failed for H=(qWQTyh3z) [45.94.31.131]:61569: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-31 02:21:03 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:53844: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-01-31 02:21:05 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:55090: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:21:12 dovecot_login authenticator failed for H=(K9on5g0YA) [185.230.124.69]:55795: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:21:11 dovecot_login authenticator failed for H=(GbkeGD3) [185.230.124.69]:52178: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:22:29 dovecot_login authenticator failed for H=(wifOwufTq) [185.230.124.69]:63822: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:22:50 H=([64.89.160.15]) [64.89.160.15]:56328 F=<drdavid00r5@outlook.com> rejected RCPT <miya@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.242
country_id: 6252001
description:
2026-01-31 02:22:14 dovecot_login authenticator failed for H=(ADMIN) [50.6.250.242]:56460: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.148.230.26
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739548 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:22:03 dovecot_login authenticator failed for H=(c5SdbI) [45.94.31.131]:64340: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-31 02:23:01 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:60866: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:22:03 dovecot_login authenticator failed for H=(yEgc2NX) [185.230.124.69]:55911: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.110
country_id: 1269750
description:
2026-01-31 02:22:52 dovecot_login authenticator failed for H=([125.19.173.191]) [59.145.160.110]:45862: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:22:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:23:02 dovecot_login authenticator failed for H=(eJnVkxsj) [45.94.31.131]:63899: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:23:39 dovecot_login authenticator failed for H=(Zd9t0dYAS) [185.230.124.69]:52573: 535 Incorrect authentication data (set_id=richard@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:23:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:23:13 dovecot_login authenticator failed for H=(V1X83Jz9a0) [185.230.124.69]:57126: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:23:38 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:24:51 dovecot_login authenticator failed for H=(JMHs9t5) [185.230.124.69]:50819: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-31 02:24:52 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:40473: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2026-01-31 02:24:02 dovecot_login authenticator failed for H=([220.180.166.214]) [220.180.166.214]:45509: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2026-01-31 02:24:33 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:33650: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:24:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:24:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:24:19 dovecot_login authenticator failed for H=(Nc77fUSM) [45.94.31.131]:54377: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:24:03 dovecot_login authenticator failed for H=(TlxZv6M) [185.230.124.69]:50391: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.60.4
country_id: 1668284
description:
2026-01-31 02:24:13 dovecot_login authenticator failed for H=(58-115-60-4.twt1.com.tw) [58.115.60.4]:47657: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.62.50.107
country_id: 1694008
description:
2026-01-31 02:24:11 dovecot_plain authenticator failed for H=(398XN2FAL8) [158.62.50.107]:57206: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:25:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:25:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:25:16 dovecot_login authenticator failed for H=(oeVw33n) [45.94.31.131]:63179: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:25:09 dovecot_login authenticator failed for H=(jDSrKz) [185.230.124.69]:54390: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:26:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-31 02:26:36 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:38482: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-01-31 02:26:53 dovecot_login authenticator failed for H=([111.26.63.87]) [111.26.63.87]:58378: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.232.252.106
country_id: 1814991
description:
2026-01-31 02:26:22 dovecot_login authenticator failed for H=([112.232.252.106]) [112.232.252.106]:51174: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-31 02:26:45 dovecot_login authenticator failed for H=([125.19.172.119]) [125.20.246.106]:46578: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:26:01 dovecot_login authenticator failed for H=(WvQZ6PF) [185.230.124.69]:58019: 535 Incorrect authentication data (set_id=charlote.ling@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:26:15 dovecot_login authenticator failed for H=(nKxgaP) [45.94.31.131]:51333: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:26:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:26:09 dovecot_login authenticator failed for H=(S5PHyh) [185.230.124.69]:51150: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:27:05 dovecot_login authenticator failed for H=(2tYx8Qzy) [185.230.124.69]:52100: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:27:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:27:15 dovecot_login authenticator failed for H=(9z35wmuB) [45.94.31.131]:49378: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.30.233
country_id: 1269750
description:
2026-01-31 02:27:50 dovecot_login authenticator failed for H=([59.90.30.233]) [59.90.30.233]:37728: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:27:04 dovecot_login authenticator failed for H=(MjRFbep) [185.230.124.69]:63073: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:27:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.198.134.241
country_id: 2017370
description:
2026-01-31 02:28:22 dovecot_login authenticator failed for H=(host-94.198.134.241.vernet.su) [94.198.134.241]:55148: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-01-31 02:28:39 dovecot_login authenticator failed for H=([103.147.248.23]) [103.147.248.23]:49730: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:28:02 dovecot_login authenticator failed for H=(5AS4NojG4) [185.230.124.69]:60356: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:28:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling@cofreth.com.my has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:28:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:28:14 dovecot_login authenticator failed for H=(F5v1wh) [45.94.31.131]:62004: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:28:15 dovecot_login authenticator failed for H=(PWAEQUM4EJ) [185.230.124.69]:61857: 535 Incorrect authentication data (set_id=recruitment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-01-31 02:28:26 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:41933: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2026-01-31 02:28:54 dovecot_login authenticator failed for H=(2-74-194-86.kcell.kz) [2.74.194.86]:55020: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:29:09 dovecot_login authenticator failed for H=(YIFOQf) [185.230.124.69]:60572: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2026-01-31 02:29:28 dovecot_login authenticator failed for H=([108.143.69.79]) [108.143.69.79]:42204: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:29:15 dovecot_login authenticator failed for H=(ZvIQOqEHxp) [45.94.31.131]:49262: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:29:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.87
country_id: 2186224
description:
2026-01-31 02:29:10 dovecot_login authenticator failed for H=([121.73.163.87]) [121.73.163.87]:49406: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:29:36 dovecot_login authenticator failed for H=(DGhDg1w3) [185.230.124.69]:64484: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-01-31 02:29:52 dovecot_login authenticator failed for H=([116.171.27.248]) [116.171.27.248]:58802: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:30:52 dovecot_login authenticator failed for H=(nH0nyyTRV3) [185.230.124.69]:64544: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-01-31 02:30:52 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:44800: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-01-31 02:30:44 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:35408: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:30:18 dovecot_login authenticator failed for H=(oS7heGAKv) [45.94.31.131]:56378: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:30:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:30:01 dovecot_login authenticator failed for H=(J7DxbNb8G) [185.230.124.69]:51947: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:31:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:31:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account celine has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:31:08 dovecot_login authenticator failed for H=(PRWHcr) [185.230.124.69]:56055: 535 Incorrect authentication data (set_id=celine)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:31:21 dovecot_login authenticator failed for H=(GETjiXNPKq) [45.94.31.131]:56727: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:32:01 dovecot_login authenticator failed for H=(JsDBL2Q2EE) [45.94.31.131]:52486: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:32:06 dovecot_login authenticator failed for H=(3GS2Kijg) [185.230.124.69]:51638: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:32:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:32:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-01-31 02:32:52 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:36860: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:32:31 dovecot_login authenticator failed for H=(K7Eq4M2) [185.230.124.69]:53314: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:33:02 dovecot_login authenticator failed for H=(LSPhlF4s6) [45.94.31.131]:49639: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:33:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-31 02:33:01 dovecot_login authenticator failed for H=(177-174-16-81.user.vivozap.com.br) [177.174.16.55]:35122: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:33:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:33:16 dovecot_login authenticator failed for H=(Bb1a5Z9s) [185.230.124.69]:61041: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:34:01 dovecot_login authenticator failed for H=(Qc8X3T4) [185.230.124.69]:58321: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:34:01 dovecot_login authenticator failed for H=(mVZ6pEr) [45.94.31.131]:65344: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:34:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:34:07 dovecot_login authenticator failed for H=(Bk2g9tx) [185.230.124.69]:53179: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:34:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:35:53 dovecot_login authenticator failed for H=(mlpwVQM) [185.230.124.69]:64464: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:35:01 dovecot_login authenticator failed for H=(bkIWXeVJT) [45.94.31.131]:63110: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:35:06 dovecot_login authenticator failed for H=(3V9IDKs8) [185.230.124.69]:50458: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:35:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:35:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:36:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:36:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:36:01 dovecot_login authenticator failed for H=(cgKDBlaC9A) [45.94.31.131]:60322: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:36:10 dovecot_login authenticator failed for H=(oVN43qk) [185.230.124.69]:50660: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:37:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:37:18 dovecot_login authenticator failed for H=(qD7VEWiHWW) [45.94.31.131]:65090: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:37:51 dovecot_login authenticator failed for H=(ZoTYRJ0jkw) [185.230.124.69]:49243: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:37:04 dovecot_login authenticator failed for H=(LnHbslXXH) [185.230.124.69]:50709: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:38:19 dovecot_login authenticator failed for H=(sGjmRT0) [185.230.124.69]:60956: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:38:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-31 02:38:09 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:53758: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:38:16 dovecot_login authenticator failed for H=(sIw2oLQgK) [45.94.31.131]:49970: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:39:05 dovecot_login authenticator failed for H=(hdSzoLw) [185.230.124.69]:55925: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:39:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:39:15 dovecot_login authenticator failed for H=(ZUWjLjjHD) [45.94.31.131]:57637: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:39:43 dovecot_login authenticator failed for H=(i5nwlz) [185.230.124.69]:55865: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.224.102
country_id: 1814991
description:
2026-01-31 02:40:36 dovecot_login authenticator failed for H=([218.15.224.102]) [218.15.224.102]:58426: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.227.51
country_id: 1835841
description:
2026-01-31 02:40:45 dovecot_login authenticator failed for H=([61.79.227.51]) [61.79.227.51]:54292: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:40:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:40:09 dovecot_login authenticator failed for H=(iIJgh9) [185.230.124.69]:60524: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-01-31 02:41:24 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net [110.25.109.52]:46860: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-01-31 02:41:36 dovecot_login authenticator failed for H=([175.206.113.91]) [175.206.113.91]:44518: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:41:01 dovecot_login authenticator failed for H=(dFViX2cu) [185.230.124.69]:55326: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-31 02:41:24 dovecot_login authenticator failed for H=([152.52.192.162]) [152.52.192.162]:39300: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:41:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:41:28 dovecot_login authenticator failed for H=(XGDZwDTXaZ) [185.230.124.69]:58898: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-31 02:41:39 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [187.58.66.231]:58205: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:42:11 dovecot_login authenticator failed for H=(G0UraBx) [185.230.124.69]:64803: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.122.20
country_id: 2017370
description:
2026-01-31 02:42:13 dovecot_login authenticator failed for H=([94.102.122.20]) [94.102.122.20]:51736: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:42:34 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.198.132.93
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Profiler/FileProfilerStorageTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:42:36 dovecot_login authenticator failed for H=(hty9H0q) [45.94.31.131]:60552: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-01-31 02:42:21 dovecot_login authenticator failed for H=([116.171.27.248]) [116.171.27.248]:33202: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:42:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:43:05 dovecot_login authenticator failed for H=(kkAOPD2RNS) [185.230.124.69]:51642: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:43:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:43:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:43:15 dovecot_login authenticator failed for H=(1e6RKeIh8) [45.94.31.131]:62324: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:43:31 dovecot_login authenticator failed for H=(q5vpqptQ) [185.230.124.69]:53247: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2026-01-31 02:44:32 dovecot_login authenticator failed for H=laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:39685: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.44.1.113
country_id: 1814991
description:
2026-01-31 02:44:49 dovecot_login authenticator failed for H=([182.44.1.113]) [182.44.1.113]:41734: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 02:44:56 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:22790: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:44:15 dovecot_login authenticator failed for H=(HvNdShhQc) [45.94.31.131]:56111: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:44:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:44:19 dovecot_login authenticator failed for H=(vPBDBzS1s) [185.230.124.69]:54500: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:44:19 H=([64.89.160.15]) [64.89.160.15]:57856 F=<essenas@outlook.com> rejected RCPT <janice@smartcable.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.152.142.83
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=33 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.4.193.97
country_id: 6252001
domain: www.gagasanteguh.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:44:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-01-31 02:44:05 dovecot_login authenticator failed for H=(red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:39388: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-31 02:45:02 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:47668: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:45:14 dovecot_login authenticator failed for H=(hb9eXQiR) [45.94.31.131]:58495: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-01-31 02:45:34 dovecot_login authenticator failed for H=([182.95.116.66]) [182.95.116.66]:33486: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:45:05 dovecot_login authenticator failed for H=(VfLEDG1) [185.230.124.69]:52606: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:45:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:45:16 dovecot_login authenticator failed for H=(AJ6Ph7qg) [185.230.124.69]:53814: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-31 02:45:25 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:38094: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:46:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:46:12 dovecot_login authenticator failed for H=(U2RbCYcvu) [45.94.31.131]:51749: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:46:13 dovecot_login authenticator failed for H=(IAj3Uue) [185.230.124.69]:63979: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:46:53 dovecot_login authenticator failed for H=(y9ZzrwcM4e) [158.94.208.110]:51800: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:47:04 dovecot_login authenticator failed for H=(aQmBq33Bv) [185.230.124.69]:64462: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:47:11 dovecot_login authenticator failed for H=(1FTZbczNF) [45.94.31.131]:53606: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:47:17 dovecot_login authenticator failed for H=(fbk5Lry) [158.94.208.110]:55930: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:47:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:47:17 dovecot_login authenticator failed for H=(1TLDyIK) [185.230.124.69]:58934: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:48:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account richard has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:48:06 dovecot_login authenticator failed for H=(dp32dSuGyg) [185.230.124.69]:53389: 535 Incorrect authentication data (set_id=richard)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:48:29 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2026-01-31 02:48:35 dovecot_login authenticator failed for H=(nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:33816: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:48:05 dovecot_login authenticator failed for H=(yaxexVA) [158.94.208.110]:63916: 535 Incorrect authentication data (set_id=louiswong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:48:11 dovecot_login authenticator failed for H=(0JFuruQnh) [45.94.31.131]:52952: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2026-01-31 02:48:26 dovecot_login authenticator failed for H=([128.185.194.190]) [128.185.194.190]:59450: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:49:12 dovecot_login authenticator failed for H=(zuNFzFEo) [158.94.208.110]:58410: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:49:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:49:13 dovecot_login authenticator failed for H=(urgIizArb) [45.94.31.131]:58585: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:49:30 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:49:32 dovecot_login authenticator failed for H=(3e7WCekuf3) [185.230.124.69]:62601: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:49:08 dovecot_login authenticator failed for H=(uBdvJj) [185.230.124.69]:49570: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:50:13 dovecot_login authenticator failed for H=(bpUcsl7oS) [45.94.31.131]:49448: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:50:16 dovecot_login authenticator failed for H=(Hu3TTBOk) [185.230.124.69]:62229: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.45
country_id: 2802361
description:
2026-01-31 02:50:46 dovecot_login authenticator failed for H=(ADMIN) [181.214.218.45]:15157: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:50:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:50:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:50:47 dovecot_login authenticator failed for H=(EAqIaA) [158.94.208.110]:57468: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-31 02:50:13 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:48684: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:51:09 dovecot_login authenticator failed for H=(YTmZnz) [185.230.124.69]:56964: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.211.111
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/BinaryFileResponseTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:51:13 dovecot_login authenticator failed for H=(A172FFk5JW) [45.94.31.131]:53643: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-01-31 02:51:28 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:53954: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.169.176
country_id: 2017370
description:
2026-01-31 02:51:45 dovecot_login authenticator failed for H=(31-220-169-176.rdtc.ru) [31.220.169.176]:35995: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2026-01-31 02:52:00 dovecot_login authenticator failed for H=([183.99.89.74]) [183.99.89.74]:58906: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:51:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:51:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 02:51:11 dovecot_login authenticator failed for H=(tPeZupf5p5) [158.94.208.110]:61543: 535 Incorrect authentication data (set_id=louiswong@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2026-01-31 02:52:09 dovecot_login authenticator failed for H=(dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:58650: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:52:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:52:21 dovecot_login authenticator failed for H=(hknxgbx9sR) [185.230.124.69]:55050: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.205.156
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/clients.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:52:09 dovecot_login authenticator failed for H=(9VHeKtfPN) [185.230.124.69]:65341: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:52:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:52:15 dovecot_login authenticator failed for H=(JRke66UCuG) [45.94.31.131]:49453: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.205.59
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/messages.yml HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:53:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:53:11 dovecot_login authenticator failed for H=(2ZNU12yp) [185.230.124.69]:60367: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:53:16 dovecot_login authenticator failed for H=(6bR0rnz) [45.94.31.131]:53637: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2026-01-31 02:54:48 dovecot_login authenticator failed for H=kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:38354: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2026-01-31 02:54:56 dovecot_login authenticator failed for H=(92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:48248: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-01-31 02:55:00 dovecot_plain authenticator failed for H=([178.16.52.51]) [178.16.52.51]:59336: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:54:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account charlote.ling has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:54:08 dovecot_login authenticator failed for H=(4zQ2t4B) [185.230.124.69]:64123: 535 Incorrect authentication data (set_id=charlote.ling)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:54:15 dovecot_login authenticator failed for H=(2v8fCK4UO) [45.94.31.131]:59159: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.232.83.3
country_id: 3175395
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/advi3535/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:55:51 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:55:02 dovecot_login authenticator failed for H=(w5zOIGis3) [185.230.124.69]:54698: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.51
country_id: 2921044
description:
2026-01-31 02:55:06 dovecot_login authenticator failed for H=([178.16.52.51]) [178.16.52.51]:59336: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:55:14 dovecot_login authenticator failed for H=(NYuwNoAK) [45.94.31.131]:62396: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: wcc.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/woh/wcc.com.my/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:56:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-31 02:56:50 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:55916: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:56:13 dovecot_login authenticator failed for H=(K5fNFAyF) [45.94.31.131]:59195: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.232.83.3
country_id: 3175395
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/advi3535/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:56:31 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:56:45 dovecot_login authenticator failed for H=(iHZy69c4h) [185.230.124.69]:58082: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:56:19 dovecot_login authenticator failed for H=(V9vxjee9q) [185.230.124.69]:55066: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:57:11 dovecot_login authenticator failed for H=(hlP7aVo) [185.230.124.69]:65320: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:57:14 dovecot_login authenticator failed for H=(Y2CQjsf) [45.94.31.131]:53385: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 13.220.185.78
country_id: 6252001
domain: mail.usfood.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:57:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:57:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-01-31 02:57:11 dovecot_login authenticator failed for H=([1.227.228.131]) [1.227.228.131]:42893: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:58:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:58:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:58:14 dovecot_login authenticator failed for H=(rI0cQY) [45.94.31.131]:58663: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-31 02:58:41 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:57859: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-31 02:58:54 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:47910: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:58:03 dovecot_login authenticator failed for H=(pFLofvsdoI) [185.230.124.69]:65504: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 02:59:14 dovecot_login authenticator failed for H=(H8KkQYcMQ5) [45.94.31.131]:50668: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
country_id: 1814991
description:
2026-01-31 02:59:22 dovecot_login authenticator failed for H=([111.39.167.59]) [111.39.167.59]:44015: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-31 02:59:41 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:49386: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 02:59:18 dovecot_login authenticator failed for H=(PC1Ud9Zjit) [185.230.124.69]:58295: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 02:59:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 02:59:41 H=([64.89.160.15]) [64.89.160.15]:52631 F=<drdavid00r5@outlook.com> rejected RCPT <roz@af-sb.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 02:59:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:00:17 dovecot_login authenticator failed for H=(mC4bEg5g) [185.230.124.69]:59704: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 03:00:54 dovecot_login authenticator failed for H=(dt5DTp) [45.94.31.131]:52043: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 45.94.31.131
country_id: 2750405
description:
Jan 31 03:00:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate has been locked for the attacker IP 45.94.31.131


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:00:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 03:00:14 dovecot_login authenticator failed for H=(54GIfZK55Y) [45.94.31.131]:61962: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-01-31 03:01:14 dovecot_login authenticator failed for H=(jymLPf2m) [45.94.31.131]:52724: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:01:14 dovecot_login authenticator failed for H=(H2bhHa) [185.230.124.69]:60982: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 03:01:37 H=([64.89.160.15]) [64.89.160.15]:55847 F=<essenas@outlook.com> rejected RCPT <miya@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-31 03:01:22 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:52810: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-01-31 03:01:44 dovecot_login authenticator failed for H=([187.7.85.97]) [201.15.149.254]:59691: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-31 03:02:47 H=(localhost.localdomain) [78.153.140.207]:41966 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:02:05 dovecot_login authenticator failed for H=(8gc6WHTiRK) [185.230.124.69]:50749: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-31 03:02:45 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:38423: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-31 03:02:54 dovecot_login authenticator failed for H=([182.95.215.69]) [182.95.230.122]:49942: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.90.205.77
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=898173 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:03:19 dovecot_login authenticator failed for H=(t9KhIgB) [185.230.124.69]:64484: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:04:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:04:10 dovecot_login authenticator failed for H=(sbXFgQcxOi) [185.230.124.69]:50497: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:05:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:05:20 dovecot_login authenticator failed for H=(DKnXdvm) [185.230.124.69]:59865: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-31 03:05:46 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:37852: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.27.79.215
country_id: 1814991
description:
2026-01-31 03:06:03 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [60.27.79.215]:9680: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:06:10 dovecot_login authenticator failed for H=(VdGnohIeAM) [185.230.124.69]:61102: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:06:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.24.104
country_id: 1269750
domain: www.box.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/woh/box.com.my/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:07:24 dovecot_login authenticator failed for H=(83NF8dZq) [185.230.124.69]:64835: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:08:09 dovecot_login authenticator failed for H=(U7NV1AC) [185.230.124.69]:50525: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.167
country_id: 2960313
description:
2026-01-31 03:08:20 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.167]:36174: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 03:08:46 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (scralmook) [87.103.126.54]:63562: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.85.123.4
country_id: 798549
description:
2026-01-31 03:08:48 dovecot_plain authenticator failed for H=(ginges) [92.85.123.4]:60420: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-31 03:09:37 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:45940: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-31 03:09:49 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:38745: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:09:20 dovecot_login authenticator failed for H=(B6PeCC) [185.230.124.69]:56747: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:10:11 dovecot_login authenticator failed for H=(iwBlnPUO6) [185.230.124.69]:55975: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.14.2
country_id: 1668284
description:
2026-01-31 03:10:42 dovecot_login authenticator failed for H=(58-115-14-2.twt1.com.tw) [58.115.14.2]:39632: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
country_id: 1814991
description:
2026-01-31 03:11:35 dovecot_login authenticator failed for H=([119.6.55.57]) [119.6.55.57]:45584: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-31 03:11:06 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:35784: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2026-01-31 03:11:14 dovecot_login authenticator failed for H=([178.178.222.58]) [178.178.222.58]:33258: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:11:14 dovecot_login authenticator failed for H=(DBUpo1O1) [185.230.124.69]:59261: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-01-31 03:11:21 dovecot_login authenticator failed for H=([116.171.27.248]) [116.171.27.248]:44424: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.91.182
country_id: 1694008
description:
2026-01-31 03:12:01 dovecot_login authenticator failed for H=([156.236.91.182]) [156.236.91.182]:51759: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.51.88
country_id: 1562822
description:
2026-01-31 03:11:55 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.51.88]:38573: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-31 03:11:05 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:63879: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:11:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:12:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:12:11 dovecot_login authenticator failed for H=(1LGFW5) [185.230.124.69]:60743: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/egbwawasancom/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:12:03 dovecot_login authenticator failed for H=(Ht76hQLMMu) [185.230.124.69]:50420: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.138
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=740138 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:13:21 dovecot_login authenticator failed for H=(VfKzYnDLD) [185.230.124.69]:57162: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:13:46 dovecot_login authenticator failed for H=(tLJXpRGC) [158.94.208.110]:60731: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.240.47.47
country_id: 2661886
domain: egbwawasan.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/egbwawasancom/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:13:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:14:05 dovecot_login authenticator failed for H=(M1iinc1me5) [185.230.124.69]:55528: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:14:03 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.173.10
country_id: 1269750
description:
2026-01-31 03:14:22 dovecot_login authenticator failed for H=(nsg-corporate-105.246.185.122.airtel.in) [122.187.173.10]:52696: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.134.123
country_id: 2802361
description:
Jan 31 03:14:57 sv3 pure-ftpd[3701363]: (?@34.76.134.123) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-01-31 03:14:10 dovecot_login authenticator failed for H=([42.1.110.201]) [42.1.110.201]:46698: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:14:10 dovecot_login authenticator failed for H=(km3B80gfZ) [158.94.208.110]:64654: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.121.202.171
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=6672338432 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:15:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:15:19 dovecot_login authenticator failed for H=(4kNUP2v46) [185.230.124.69]:57826: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/oxboldc/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:15:20 dovecot_login authenticator failed for H=(KhbKrDbzV) [158.94.208.110]:53753: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2026-01-31 03:16:01 dovecot_login authenticator failed for H=([179.185.18.67]) [179.185.18.67]:50987: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:16:06 dovecot_login authenticator failed for H=(CjrbEwQH) [185.230.124.69]:52292: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:16:08 dovecot_login authenticator failed for H=(SjF9JsYrrg) [158.94.208.110]:53897: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-01-31 03:16:54 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:49538: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-01-31 03:16:22 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:37116: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:17:06 dovecot_login authenticator failed for H=(cIgBzTiG2o) [185.230.124.69]:63467: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:17:19 dovecot_login authenticator failed for H=(n0PO2kI554) [158.94.208.110]:64070: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2026-01-31 03:17:03 dovecot_login authenticator failed for H=([31.173.66.222]) [31.173.66.222]:58930: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:17:32 dovecot_login authenticator failed for H=(JMoTgR) [185.230.124.69]:60095: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:18:24 dovecot_login authenticator failed for H=(jYTtVFYS1) [185.230.124.69]:51553: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:18:07 dovecot_login authenticator failed for H=(ibNW37) [158.94.208.110]:55711: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 176.120.22.61
country_id: 2017370
description:
2026-01-31  3:18:15 8322 [Warning] Aborted connection 8322 to db: 'unconnected' user: 'unauthenticated' host: '176.120.22.61' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:19:15 dovecot_login authenticator failed for H=(FrBKhM) [185.230.124.69]:57845: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:19:32 dovecot_login authenticator failed for H=(l8r5LA) [69.5.189.21]:64351: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:19:58 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:19:17 dovecot_login authenticator failed for H=(ZTbfRM) [158.94.208.110]:50812: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.108.14.225
country_id: 1814991
description:
2026-01-31 03:19:55 dovecot_login authenticator failed for H=([202.108.14.226]) [202.108.14.225]:55816: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-01-31 03:20:02 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:40238: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:20:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:20:18 dovecot_login authenticator failed for H=(Voqchw) [185.230.124.69]:58584: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:20:20 dovecot_login authenticator failed for H=(fLjUnH) [69.5.189.21]:55887: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-31 03:20:05 dovecot_login authenticator failed for H=(ilbkudVvE) [158.94.208.110]:58401: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:21:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:21:10 dovecot_login authenticator failed for H=(RnehIX) [185.230.124.69]:57009: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:21:30 dovecot_login authenticator failed for H=(SuvPAY) [69.5.189.21]:51177: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.99
country_id: 1814991
description:
2026-01-31 03:21:34 dovecot_login authenticator failed for H=([111.26.100.98]) [111.26.100.99]:48488: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2026-01-31 03:21:55 dovecot_login authenticator failed for H=([58.16.201.52]) [58.16.201.52]:42104: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:22:01 dovecot_login authenticator failed for H=(MCN8SiTK) [185.230.124.69]:50573: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:22:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-31 03:22:46 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:49458: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.55.57
country_id: 1814991
description:
2026-01-31 03:22:56 dovecot_login authenticator failed for H=([119.6.55.57]) [119.6.55.57]:38350: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:22:17 dovecot_login authenticator failed for H=(bVC9X1) [69.5.189.21]:65196: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 03:22:22 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:60734: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/printspecsolutio/public_html/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:23:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:23:27 dovecot_login authenticator failed for H=(lvZuebrG) [69.5.189.21]:59179: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:23:17 dovecot_login authenticator failed for H=(XaZeYCTE) [185.230.124.69]:60467: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:24:02 dovecot_login authenticator failed for H=(wbU2rPS) [185.230.124.69]:56592: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-31 03:24:04 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:42272: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-01-31 03:24:19 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:46401: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.88.98.132
country_id: 6252001
description:
[2026-01-31 03:24:21 +0800] info [whostmgrd] 24.88.98.132 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-31 03:24:59 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:62674: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:24:00 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-31 03:24:14 dovecot_login authenticator failed for H=(ACzU9j) [69.5.189.21]:50594: 535 Incorrect authentication data (set_id=rafidah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
country_id: 1835841
description:
2026-01-31 03:24:30 dovecot_login authenticator failed for H=([58.226.255.240]) [58.226.255.240]:3560: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:25:13 dovecot_login authenticator failed for H=(PmLwMKR) [185.230.124.69]:55370: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-31 03:26:56 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:47940: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-01-31 03:26:39 dovecot_login authenticator failed for H=([220.80.223.144]) [220.80.223.144]:57458: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.40.134
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 35.216.189.16
country_id: 2658434
description:
2026-01-31  3:26:43 8603 [Warning] Aborted connection 8603 to db: 'unconnected' user: 'unauthenticated' host: '35.216.189.16' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 35.216.189.16
country_id: 2658434
description:
2026-01-31  3:26:46 8610 [Warning] Aborted connection 8610 to db: 'unconnected' user: 'unauthenticated' host: '35.216.189.16' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:26:05 dovecot_login authenticator failed for H=(nimYur) [185.230.124.69]:64162: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:27:11 dovecot_login authenticator failed for H=(wlLpLEjezZ) [185.230.124.69]:52811: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.183.44
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=340379 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-31 03:27:46 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:47680: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-01-31 03:28:00 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:50354: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.36
country_id: 2589581
description:
2026-01-31 03:28:16 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.36]:21428: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:28:45 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:28:02 dovecot_login authenticator failed for H=(jOluvjesM) [185.230.124.69]:63721: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:29:14 dovecot_login authenticator failed for H=(pgBCGz) [185.230.124.69]:50217: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.136
country_id: 99237
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=9481 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:29:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/krisfood/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.34
country_id: 1269750
description:
2026-01-31 03:30:30 dovecot_login authenticator failed for H=([203.145.159.97]) [182.95.231.34]:43798: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:30:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:30:04 dovecot_login authenticator failed for H=(FeymIY) [185.230.124.69]:60847: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.223.146
country_id: 1562822
description:
2026-01-31 03:30:39 dovecot_login authenticator failed for H=([125.212.223.146]) [125.212.223.146]:14157: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:31:20 8767 [Warning] Aborted connection 8767 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:31:32 dovecot_login authenticator failed for H=(tCBAQTF7) [185.230.124.69]:57225: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.177.234
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=501726 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:31:13 dovecot_login authenticator failed for H=(nHhtOQCNV) [185.230.124.69]:51747: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:32:24 dovecot_login authenticator failed for H=(Y064S5) [185.230.124.69]:63566: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:33:09 dovecot_login authenticator failed for H=(Aoo1PZfe5) [185.230.124.69]:54136: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:33:09 8851 [Warning] Aborted connection 8851 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:34:24 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:34:26 dovecot_login authenticator failed for H=(ooZPo25o) [185.230.124.69]:65168: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-01-31 03:35:03 dovecot_login authenticator failed for H=([182.95.215.92]) [122.186.255.50]:59202: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:35:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2026-01-31 03:35:12 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:50452: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:35:18 dovecot_login authenticator failed for H=(hxBvL5) [185.230.124.69]:55131: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.90.138
country_id: 2077456
description:
2026-01-31 03:36:12 dovecot_login authenticator failed for H=([123.209.90.138]) [123.209.90.138]:49470: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-31 03:36:21 dovecot_login authenticator failed for H=([200.164.226.113]) [200.149.213.242]:47018: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.110.201
country_id: 1562822
description:
2026-01-31 03:36:29 dovecot_login authenticator failed for H=([42.1.110.203]) [42.1.110.201]:42304: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:36:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:36:11 dovecot_login authenticator failed for H=(vIMRN9e) [185.230.124.69]:55407: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2026-01-31 03:36:20 dovecot_login authenticator failed for H=([39.125.67.109]) [39.125.67.109]:50406: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-01-31  3:36:41 9029 [Warning] Aborted connection 9029 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-01-31 03:36:56 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net [110.25.109.52]:54851: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2026-01-31 03:37:06 dovecot_login authenticator failed for H=([211.253.10.61]) [211.253.10.61]:37486: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:37:04 dovecot_login authenticator failed for H=(PdStimhIp) [185.230.124.69]:59359: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:37:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.159.99.193
country_id: 6252001
description:
2026-01-31 03:38:54 dovecot_plain authenticator failed for H=(uniniate) [192.159.99.193]:49392: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: u-net.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home/unetcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: myfurnitureshop.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/myfurnit/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:38:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:38:25 dovecot_login authenticator failed for H=(k1gQRoUPB) [185.230.124.69]:63082: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-31 03:38:52 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.62.173.90
country_id: 1814991
description:
2026-01-31 03:39:52 dovecot_login authenticator failed for H=([111.62.173.90]) [111.62.173.90]:50244: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:39:18 dovecot_login authenticator failed for H=(RuAZhmhqh) [185.230.124.69]:55792: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2026-01-31 03:40:20 dovecot_login authenticator failed for H=(host-94.124.225.159.gascom.net.ru) [94.124.225.159]:56324: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2026-01-31 03:40:06 dovecot_login authenticator failed for H=([167.250.118.12]) [167.250.118.12]:44034: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:40:09 dovecot_login authenticator failed for H=(oudm3bK0O) [185.230.124.69]:63280: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-01-31 03:40:15 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:9142: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:41:26 dovecot_login authenticator failed for H=(neROqNo) [185.230.124.69]:64527: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2026-01-31 03:42:00 dovecot_login authenticator failed for H=([37.34.237.45]) [37.34.237.45]:47828: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.115.88
country_id: 1814991
description:
2026-01-31 03:41:51 dovecot_login authenticator failed for H=([183.6.115.88]) [183.6.115.88]:39978: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.157.195.127
country_id: 2464461
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=435578 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:42:02 9193 [Warning] Aborted connection 9193 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:42:18 dovecot_login authenticator failed for H=(mIHzt1Df) [185.230.124.69]:58030: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-31 03:42:34 dovecot_login authenticator failed for H=(made-again.tmesis.com) [24.187.213.29]:44822: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-31 03:42:10 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:45252: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:43:11 dovecot_login authenticator failed for H=(0byfYaTh) [185.230.124.69]:63141: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.231.0.209
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:43:35 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.125.227.177
country_id: 1269750
domain: thinkcloud.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:79004.thinkcloud.com.my||ServerName:thinkcloud.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26bccaecb9c4468493842a4d741644f0f7019b7f||Title:0xddbe992c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:44:03 dovecot_login authenticator failed for H=(xBnozSTsRC) [185.230.124.69]:61528: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:44:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.152.240
country_id: 1861060
domain: mymetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/cabecom/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:45:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:45:14 dovecot_login authenticator failed for H=(bU2GGCa) [185.230.124.69]:59905: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-01-31 03:46:49 dovecot_login authenticator failed for H=([115.244.235.242]) [117.248.107.130]:43952: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.173
country_id: 102358
description:
2026-01-31 03:46:05 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.173]:11075: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:46:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-01-31 03:46:28 dovecot_login authenticator failed for H=([59.16.192.32]) [59.16.192.32]:48682: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: stealthvenom.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/cabecom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:46:13 dovecot_login authenticator failed for H=(WBlgniZO3i) [185.230.124.69]:53299: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 03:46:46 H=([64.89.160.15]) [64.89.160.15]:57015 F=<essenas@outlook.com> rejected RCPT <roz@af-sb.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:47:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:47:03 dovecot_login authenticator failed for H=(Inlkq2) [185.230.124.69]:57720: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:47:21 dovecot_login authenticator failed for H=(9eudRAzNuw) [158.94.209.22]:56482: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: modsec
rule: 77350097
name: IM360 WAF: SQL Injection via id parameter
abuser: 209.126.85.246
country_id: 6252001
domain: smartcable.com.my
description:
IM360 WAF: SQL Injection via id parameter||MV:806703 /**//**/OR/**/JSON_KEYS((SELECT/**/CONVERT((SELECT/**/CONCAT(0x736b5958,(SELECT/**/(ELT(2836=2836,1))),0x6d466865))/**/USING/**/utf8)))\r||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: thinkcloud.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/thinkcloudadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-31 03:48:49 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:17671: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 209.126.85.246
country_id: 6252001
domain: smartcable.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:806703 /**//**/or/**/json_keys((select/**/convert((select/**/concat(0x736b5958,(select/**/(elt(2836=2836,1))),0x6d466865))/**/using/**/utf8)))\r||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:48:15 dovecot_login authenticator failed for H=(yTISqZkebo) [158.94.209.22]:52543: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:48:16 dovecot_login authenticator failed for H=(IfZJ6ud81q) [185.230.124.69]:55594: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:49:07 dovecot_login authenticator failed for H=(bfAxxxbK61) [185.230.124.69]:51471: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.242.214
country_id: 290557
description:
2026-01-31 03:49:52 dovecot_login authenticator failed for H=([80.227.242.214]) [80.227.242.214]:40736: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.113.235
country_id: 3017382
domain: thinkcloud.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/index.php||SC:/home2/thinkcloudadmin/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2026-01-31 03:49:05 dovecot_login authenticator failed for H=([124.114.149.106]) [124.114.149.106]:44336: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:49:09 dovecot_login authenticator failed for H=(sIdzce) [158.94.209.22]:59086: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
country_id: 2017370
description:
2026-01-31 03:49:38 dovecot_login authenticator failed for H=([178.178.194.137]) [178.178.194.137]:49990: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:50:57 dovecot_login authenticator failed for H=(P0jhJNnG) [158.94.209.22]:60465: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:50:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.14.232
country_id: 1835841
description:
2026-01-31 03:50:13 dovecot_plain authenticator failed for H=(1k3p2bk9yt3spl5u1gijcjz4kgyz) [221.163.14.232]:49640: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home/airefresh/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-01-31 03:50:45 dovecot_login authenticator failed for H=([125.61.48.234]) [125.61.48.234]:36561: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.129.2
country_id: 1814991
description:
2026-01-31 03:50:58 dovecot_login authenticator failed for H=(2.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:57634: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:50:03 dovecot_login authenticator failed for H=(iIrOthHLB) [158.94.209.22]:54142: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:50:23 dovecot_login authenticator failed for H=(Ust6Oyzt) [185.230.124.69]:51689: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:51:06 dovecot_login authenticator failed for H=(0zyz23cXT) [185.230.124.69]:56415: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
country_id: 1814991
description:
2026-01-31 03:51:10 dovecot_login authenticator failed for H=([220.172.203.43]) [220.172.203.43]:33360: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.67.85
country_id: 2017370
description:
2026-01-31 03:51:23 dovecot_login authenticator failed for H=([87.251.67.85]) [87.251.67.85]:57920: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:51:52 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:51:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:51:15 dovecot_login authenticator failed for H=(3QTZ3WjBw) [158.94.209.22]:56419: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:52:33 9686 [Warning] Aborted connection 9686 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:52:07 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:52:09 dovecot_login authenticator failed for H=(D83i8LYdb) [158.94.209.22]:55917: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:52:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2026-01-31 03:52:48 dovecot_login authenticator failed for H=([122.225.203.106]) [122.225.203.106]:58101: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:52:04 dovecot_login authenticator failed for H=(OS8p7Tg6) [185.230.124.69]:55711: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.17.35.83
country_id: 6252001
description:
[2026-01-31 03:53:54 +0800] info [cpaneld] 100.17.35.83 - cofreth "GET /login/?login_only=1&user=cofreth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:53:03 dovecot_login authenticator failed for H=(n2HyJ8o) [158.94.209.22]:62104: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: acburn.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home2/acburnco/public_html/assets/images||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:53:20 dovecot_login authenticator failed for H=(dxMnpbaoI) [185.230.124.69]:56322: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.8.91.175
country_id: 6252001
description:
[2026-01-31 03:53:50 +0800] info [cpaneld] 67.8.91.175 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:53:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:53:53 9736 [Warning] Aborted connection 9736 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.253.138
country_id: 6252001
description:
[2026-01-31 03:53:58 +0800] info [cpaneld] 73.205.253.138 - cofrethcomm "GET /login/?login_only=1&user=cofrethcomm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcomm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.221.67.69
country_id: 6252001
description:
[2026-01-31 03:53:47 +0800] info [cpaneld] 71.221.67.69 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-01-31 03:53:03 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.86]:43396: 535 Incorrect authentication data (set_id=zainuddin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.122.192.129
country_id: 6252001
description:
[2026-01-31 03:53:56 +0800] info [cpaneld] 69.122.192.129 - cofrethcommy "GET /login/?login_only=1&user=cofrethcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcommy (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:53:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:53:04 dovecot_login authenticator failed for H=(8f5djUty) [185.230.124.69]:64222: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.172.118.155
country_id: 6252001
description:
[2026-01-31 03:54:39 +0800] info [cpaneld] 174.172.118.155 - cofreth6 "GET /login/?login_only=1&user=cofreth6&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth6 (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:54:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.226.254
country_id: 6252001
description:
[2026-01-31 03:54:23 +0800] info [cpaneld] 73.74.226.254 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.36.10.80
country_id: 6252001
description:
[2026-01-31 03:54:30 +0800] info [cpaneld] 99.36.10.80 - cofreth3 "GET /login/?login_only=1&user=cofreth3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth3 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-31 03:54:54 dovecot_login authenticator failed for H=(cm-178.232.23.140.get.no) [178.232.23.140]:53787: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:54:03 dovecot_login authenticator failed for H=(7VQ6M5pcN2) [185.230.124.69]:53631: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.114.138.44
country_id: 6252001
description:
[2026-01-31 03:54:45 +0800] info [cpaneld] 76.114.138.44 - cofreth8 "GET /login/?login_only=1&user=cofreth8&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth8 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.71.181.249
country_id: 6252001
description:
[2026-01-31 03:54:18 +0800] info [cpaneld] 74.71.181.249 - cofr "GET /login/?login_only=1&user=cofr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2026-01-31 03:54:23 dovecot_login authenticator failed for H=([178.178.194.192]) [178.178.194.192]:46092: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.181.106.223
country_id: 6252001
description:
[2026-01-31 03:54:49 +0800] info [cpaneld] 72.181.106.223 - cofreth9 "GET /login/?login_only=1&user=cofreth9&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth9 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.85.65.148
country_id: 6252001
description:
[2026-01-31 03:54:13 +0800] info [cpaneld] 67.85.65.148 - cofret "GET /login/?login_only=1&user=cofret&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofret (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.167.226.113
country_id: 6252001
description:
[2026-01-31 03:54:33 +0800] info [cpaneld] 107.167.226.113 - cofreth4 "GET /login/?login_only=1&user=cofreth4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.236.33
country_id: 6252001
description:
[2026-01-31 03:54:25 +0800] info [cpaneld] 174.134.236.33 - cofreth1 "GET /login/?login_only=1&user=cofreth1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.196.194.140
country_id: 6252001
description:
[2026-01-31 03:54:27 +0800] info [cpaneld] 107.196.194.140 - cofreth2 "GET /login/?login_only=1&user=cofreth2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth2 (has_cpuser_file failed)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.140
country_id: 2635167
description:
2026-01-31  3:54:09 9751 [Warning] Aborted connection 9751 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.140' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:54:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.199.227.198
country_id: 6252001
description:
[2026-01-31 03:54:06 +0800] info [cpaneld] 76.199.227.198 - cofrethco "GET /login/?login_only=1&user=cofrethco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethco (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.245.56
country_id: 6252001
description:
[2026-01-31 03:54:20 +0800] info [cpaneld] 99.44.245.56 - cof "GET /login/?login_only=1&user=cof&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cof (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.238.103.168
country_id: 6252001
description:
[2026-01-31 03:54:36 +0800] info [cpaneld] 174.238.103.168 - cofreth5 "GET /login/?login_only=1&user=cofreth5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth5 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.118.187.46
country_id: 6252001
description:
[2026-01-31 03:54:41 +0800] info [cpaneld] 69.118.187.46 - cofreth7 "GET /login/?login_only=1&user=cofreth7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.109.221.116
country_id: 6252001
description:
[2026-01-31 03:54:15 +0800] info [cpaneld] 98.109.221.116 - cofre "GET /login/?login_only=1&user=cofre&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofre (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:54:16 dovecot_login authenticator failed for H=(ATEZXMwOH) [158.94.209.22]:52346: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2026-01-31 03:55:41 dovecot_login authenticator failed for H=([202.90.133.142]) [202.90.133.142]:53176: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2026-01-31 03:55:50 dovecot_login authenticator failed for H=([116.246.31.172]) [116.246.31.172]:38104: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.200.240.65
country_id: 2017370
description:
2026-01-31 03:55:50 dovecot_plain authenticator failed for H=ismtj.co (9cx1bk0skrh5ys4sdhb) [185.200.240.65]:47234: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2026-01-31 03:55:59 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:59118: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:55:10 dovecot_login authenticator failed for H=(RN4tMHTgiu) [158.94.209.22]:65415: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:55:16 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:55:18 dovecot_login authenticator failed for H=(lEguEbN9IW) [185.230.124.69]:62621: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:56:04 dovecot_login authenticator failed for H=(wXZK7oPe3) [158.94.209.22]:58263: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:56:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:56:12 dovecot_login authenticator failed for H=(NpOeXT3WHP) [185.230.124.69]:50448: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:56:15 dovecot_login authenticator failed for H=(JSTTKM8DV) [185.230.124.69]:64651: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-01-31 03:56:16 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:60824: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-31 03:57:32 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:53020: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.204
country_id: 337996
description:
2026-01-31 03:57:43 dovecot_login authenticator failed for H=([197.156.121.38]) [213.55.85.204]:7290: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:57:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-31 03:57:08 H=([64.89.160.15]) [64.89.160.15]:59438 F=<essenas@outlook.com> rejected RCPT <sales@cordage.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:57:16 dovecot_login authenticator failed for H=(pKbuMQ46n) [158.94.209.22]:50726: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:57:50 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:57:04 dovecot_login authenticator failed for H=(7vuKKQko) [185.230.124.69]:61194: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.209.22
country_id: 2750405
description:
Jan 31 03:58:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account seng-tet.poong has been locked for the attacker IP 158.94.209.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.209.22
country_id: 2750405
description:
2026-01-31 03:58:10 dovecot_login authenticator failed for H=(WnPyCDRisR) [158.94.209.22]:55477: 535 Incorrect authentication data (set_id=seng-tet.poong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:58:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:58:13 dovecot_login authenticator failed for H=(lT8NzXhJ0) [185.230.124.69]:59384: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:58:37 dovecot_login authenticator failed for H=(xynIbSj) [185.230.124.69]:55869: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 03:59:03 dovecot_login authenticator failed for H=(SO68gPp) [185.230.124.69]:55416: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 03:59:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home2/cabecom/public_html/wp-content||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:00:19 dovecot_login authenticator failed for H=(WLaWBmq8qA) [185.230.124.69]:53415: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-31 04:00:01 H=([46.151.182.48]) [46.151.182.48]:58107 F=<cpanel@chs.com.my> rejected RCPT <sales@chs.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2026-01-31 04:00:07 dovecot_login authenticator failed for H=([218.25.233.22]) [218.25.233.22]:37673: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:00:15 dovecot_login authenticator failed for H=(okdVOGv9el) [185.230.124.69]:63873: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:00:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.129.202
country_id: 1814991
description:
2026-01-31 04:00:25 dovecot_login authenticator failed for H=([120.236.70.4]) [120.196.129.202]:45807: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:01:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:01:10 dovecot_login authenticator failed for H=(7nqE98W) [185.230.124.69]:57529: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.109.92.39
country_id: 3469034
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/products_ABS.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:02:02 dovecot_login authenticator failed for H=(5sPdMlS7) [185.230.124.69]:51541: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.178.169
country_id: 2017370
description:
2026-01-31 04:02:17 dovecot_plain authenticator failed for H=(w307pta9fvqag4g560y3rrcdxmlvdhd) [95.66.178.169]:44404: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 182.62.159.0
country_id: 1733045
domain: www.indfinitydesign.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:02:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:02:13 dovecot_login authenticator failed for H=(OXYLkflQJZ) [185.230.124.69]:61535: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-31 04:02:21 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:20591: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.162.121.31
country_id: 690791
description:
2026-01-31 04:02:31 dovecot_login authenticator failed for H=([81.162.121.31]) [81.162.121.31]:56434: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.96.38
country_id: 1512440
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/ServerBagTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.137.92
country_id: 1835841
domain: pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/pftfood/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-31 04:03:48 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:47774: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.244.33.80
country_id: 1880251
description:
[2026-01-31 04:03:53 +0800] info [webmaild] 143.244.33.80 - central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:03:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:03:03 dovecot_login authenticator failed for H=(JoRaInvx) [185.230.124.69]:63482: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:04:13 dovecot_login authenticator failed for H=(BegznZq2u) [185.230.124.69]:61007: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.251
country_id: 1733045
description:
2026-01-31 04:04:34 dovecot_login authenticator failed for H=([49.124.150.251]) [49.124.150.251]:34516: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home2/krisfood/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.70.186.174
country_id: 2077456
domain: mail.wohcheong.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/woh/public_html/wp-includes||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/classwithtostring.php||WPU:||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:04:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:04:04 dovecot_login authenticator failed for H=(Dj5T2X) [185.230.124.69]:62776: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2026-01-31 04:04:16 dovecot_login authenticator failed for H=([182.78.144.34]) [182.78.144.34]:41090: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:05:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/krisfood/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wlw/autoload_classmap.php||SC:/home2/krisfood/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-01-31 04:05:10 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:45280: 535 Incorrect authentication data (set_id=ysl)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 52.140.123.244
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.71||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:06:01 dovecot_login authenticator failed for H=(xOw3yCTG8) [185.230.124.69]:51469: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:05:03 dovecot_login authenticator failed for H=(u6Ye0cjq) [185.230.124.69]:55102: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:06:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.61
country_id: 3144096
description:
2026-01-31 04:06:47 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.61]:15204: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:06:05 dovecot_login authenticator failed for H=(ipua41BN) [185.230.124.69]:60327: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-31 04:06:11 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (stroce) [87.103.126.54]:21864: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-01-31 04:07:33 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:49474: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: vc-b.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/vcbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:07:51 dovecot_login authenticator failed for H=(qBncbFl4x) [178.16.54.22]:65516: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:07:12 dovecot_login authenticator failed for H=(gTPNyW) [185.230.124.69]:57401: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.30.190.49
country_id: 2921044
description:
2026-01-31 04:07:39 H=([113.30.190.49]) [113.30.190.49]:56156 F=<administrator@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-31 04:07:43 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1712: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:07:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:07:59 dovecot_login authenticator failed for H=(zOoxn6eX) [185.230.124.69]:62257: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2026-01-31 04:09:01 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:56409: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.250.185.130
country_id: 2542007
description:
2026-01-31 04:08:07 dovecot_login authenticator failed for H=(crqwTu) [41.250.185.130]:61879: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:08:02 dovecot_login authenticator failed for H=(kZeDcCu) [185.230.124.69]:60928: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:08:33 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2026-01-31 04:08:36 dovecot_login authenticator failed for H=([178.178.222.47]) [178.178.222.47]:48512: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:09:18 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-31 04:09:45 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:56024: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:09:47 dovecot_login authenticator failed for H=(QpdgpV6) [185.230.124.69]:53580: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/file.php||SC:/home2/advi3535/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:09:23 dovecot_login authenticator failed for H=(QXHlSXMiu) [178.16.54.22]:64745: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-31 04:09:23 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (andesse) [71.224.169.28]:44130: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:09:02 dovecot_login authenticator failed for H=(ETlvo9uRu) [185.230.124.69]:58717: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:10:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:10:47 dovecot_login authenticator failed for H=(WsEiHuTBj) [178.16.54.22]:59229: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:10:06 dovecot_login authenticator failed for H=(PB6mZ1) [185.230.124.69]:53296: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:10:34 dovecot_login authenticator failed for H=(kpeE5k0h) [193.26.115.228]:60300: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:11:48 dovecot_login authenticator failed for H=(W3CNPpG) [185.230.124.69]:62460: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:11:04 dovecot_login authenticator failed for H=(s2AMKt) [185.230.124.69]:62668: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:11:14 dovecot_login authenticator failed for H=(8q9amaOk) [193.26.115.228]:52892: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:11:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:11:33 dovecot_login authenticator failed for H=(rto8zEm) [178.16.54.22]:59872: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:12:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:12:15 dovecot_login authenticator failed for H=(tb4MNIq) [185.230.124.69]:54767: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:12:11 dovecot_login authenticator failed for H=(AgF9LXYDK4) [193.26.115.228]:55642: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:13:08 dovecot_login authenticator failed for H=(I7OkWAdpT) [185.230.124.69]:62458: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:13:08 dovecot_login authenticator failed for H=(zrN7pE) [193.26.115.228]:58261: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:13:25 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:13:58 dovecot_login authenticator failed for H=(UPg2m67x) [185.230.124.69]:57094: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:13:06 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:13:19 dovecot_login authenticator failed for H=(OiyEYsS) [178.16.54.22]:49190: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:14:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest@eminent.st has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:14:44 dovecot_login authenticator failed for H=(TP4gD8) [178.16.54.22]:55657: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:14:04 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:14:17 dovecot_login authenticator failed for H=(y3JgBLMZv) [185.230.124.69]:59976: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:14:06 dovecot_login authenticator failed for H=(F5BFAoev) [193.26.115.228]:61407: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:15:44 dovecot_login authenticator failed for H=(bmRlQWsV) [185.230.124.69]:64179: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.202.86
country_id: 1814991
description:
2026-01-31 04:15:03 dovecot_login authenticator failed for H=([222.85.202.86]) [222.85.202.86]:39500: 535 Incorrect authentication data (set_id=aziz@euratech.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:15:08 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@ms-chemicals.net has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:15:10 dovecot_login authenticator failed for H=(s2fwqLNUCo) [185.230.124.69]:57684: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:15:11 dovecot_login authenticator failed for H=(f68xq5wh2p) [178.16.54.22]:60586: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:15:03 dovecot_login authenticator failed for H=(hTBvETHR) [193.26.115.228]:63668: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2026-01-31 04:15:13 dovecot_login authenticator failed for H=([182.95.125.122]) [182.95.125.122]:33134: 535 Incorrect authentication data (set_id=aziz)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:15:21 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:15:59 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.50.224
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=518721 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:16:25 dovecot_login authenticator failed for H=(itkolKMRV) [178.16.54.22]:65234: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.60
country_id: 1210997
description:
2026-01-31 04:16:42 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.60]:36059: 535 Incorrect authentication data (set_id=www.facebook.comrnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:16:08 dovecot_login authenticator failed for H=(kZGlz4bb) [185.230.124.69]:52939: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-01-31 04:16:24 dovecot_login authenticator failed for H=([182.95.20.55]) [182.95.228.106]:60204: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:16:01 dovecot_login authenticator failed for H=(UHN9Xb4zyb) [193.26.115.228]:50658: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:17:49 dovecot_login authenticator failed for H=(cNifMLs) [185.230.124.69]:54382: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.146
country_id: 2635167
description:
2026-01-31  4:17:59 10687 [Warning] Aborted connection 10687 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.146' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-31 04:17:04 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:53778: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:17:07 dovecot_login authenticator failed for H=(ktszal7Z) [185.230.124.69]:62625: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:17:17 dovecot_login authenticator failed for H=(A4lDuJoEhW) [193.26.115.228]:59098: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:17:34 dovecot_login authenticator failed for H=(mz1hRMK2hi) [178.16.54.22]:61110: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:17:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-01-31 04:17:12 dovecot_login authenticator failed for H=([103.111.6.121]) [103.111.6.121]:54305: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:17:15 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.109.200.181
country_id: 1814991
description:
2026-01-31 04:18:40 dovecot_login authenticator failed for H=([223.109.200.181]) [223.109.200.181]:58826: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:18:03 dovecot_login authenticator failed for H=(APh8f9PtiO) [185.230.124.69]:59112: 535 Incorrect authentication data (set_id=choong.kinsin@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:18:07 dovecot_login authenticator failed for H=(NZLXRAY7X) [178.16.54.22]:60843: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:18:14 dovecot_login authenticator failed for H=(BZAj6ki) [193.26.115.228]:61946: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-31 04:18:26 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:41224: 535 Incorrect authentication data (set_id=editor@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:18:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:19:51 dovecot_login authenticator failed for H=(9rDjRwnXSZ) [185.230.124.69]:59236: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:19:01 dovecot_login authenticator failed for H=(9y561vH2v) [185.230.124.69]:50449: 535 Incorrect authentication data (set_id=ernest@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:19:03 dovecot_login authenticator failed for H=(l0Ir6RrU3) [178.16.54.22]:65037: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:19:05 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin@nexuscollection.com has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:19:12 dovecot_login authenticator failed for H=(rakiODCV2n) [193.26.115.228]:64696: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-31 04:20:24 dovecot_plain authenticator failed for H=(miceraly) [91.73.188.251]:45144: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2026-01-31 04:20:36 dovecot_login authenticator failed for H=([223.241.214.127]) [223.241.214.127]:33548: 535 Incorrect authentication data (set_id=mail.urban.myexport@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:20:13 dovecot_login authenticator failed for H=(WF8eyUVR) [185.230.124.69]:56943: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:20:14 dovecot_login authenticator failed for H=(cNcEz7) [178.16.54.22]:61492: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-31 04:20:56 dovecot_login authenticator failed for H=([200.164.226.113]) [200.149.213.242]:40082: 535 Incorrect authentication data (set_id=mail.urban.myexport)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:20:11 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:20:09 dovecot_login authenticator failed for H=(vQR7pvg) [193.26.115.228]:52613: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.239.52.100
country_id: 1831722
description:
2026-01-31 04:20:03 dovecot_plain authenticator failed for H=(2wvgd48bd5shcuh63pvn) [103.239.52.100]:37127: 535 Incorrect authentication data (set_id=nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:21:01 dovecot_login authenticator failed for H=(nKb6O8e) [185.230.124.69]:62557: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:21:02 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:21:15 dovecot_login authenticator failed for H=(qPsCq5sCYg) [178.16.54.22]:62586: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:21:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.empirelog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/empi7862/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:21:06 dovecot_login authenticator failed for H=(7Yp2B3D9) [193.26.115.228]:58499: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-31 04:21:12 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:35856: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.222.237
country_id: 1210997
description:
2026-01-31 04:21:32 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.222.237]:42556: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:21:52 dovecot_login authenticator failed for H=(h6J8mZqPn) [185.230.124.69]:62102: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:22:16 dovecot_login authenticator failed for H=(kaU5Uv) [178.16.54.22]:55751: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:22:19 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-01-31 04:22:46 dovecot_plain authenticator failed for H=(mentran) [65.20.143.159]:36499: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.176.183
country_id: 1861060
domain: mail.empirelog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home2/empi7862/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.138
country_id: 1269750
description:
2026-01-31 04:22:16 dovecot_login authenticator failed for H=([182.95.215.123]) [125.23.183.138]:42336: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:22:18 dovecot_login authenticator failed for H=(AqyEmHGIC) [185.230.124.69]:52927: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2026-01-31 04:22:26 dovecot_login authenticator failed for H=([124.114.149.106]) [124.114.149.106]:41830: 535 Incorrect authentication data (set_id=zainuddin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:22:01 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.75.54.243
country_id: 1819730
domain: oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/oxboldc/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-31 04:22:58 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:37690: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:22:03 dovecot_login authenticator failed for H=(e1W1nG) [193.26.115.228]:64506: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.15
country_id: 3175395
description:
2026-01-31 04:23:02 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.15]:19209: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:23:06 dovecot_login authenticator failed for H=(vfmxcBR) [178.16.54.22]:63742: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:23:07 dovecot_login authenticator failed for H=(RfXJIkP35f) [185.230.124.69]:58389: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:23:17 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:23:19 dovecot_login authenticator failed for H=(GWzaAOZRC) [193.26.115.228]:50292: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.40.121.4
country_id: 1643084
description:
2026-01-31 04:23:52 dovecot_login authenticator failed for H=(ip-4.121.40.jogjaringan.net.id) [103.40.121.4]:34334: 535 Incorrect authentication data (set_id=editor@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.13.66
country_id: 1814991
description:
2026-01-31 04:23:07 dovecot_login authenticator failed for H=([59.37.13.66]) [59.37.13.66]:49987: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:23:09 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:23:51 dovecot_login authenticator failed for H=(Cp5BgLLpfn) [185.230.124.69]:64460: 535 Incorrect authentication data (set_id=ernest)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:24:03 dovecot_login authenticator failed for H=(qkkTbt) [178.16.54.22]:64020: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:24:10 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account choong.kinsin has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:24:12 dovecot_login authenticator failed for H=(HthDjYf) [185.230.124.69]:59730: 535 Incorrect authentication data (set_id=choong.kinsin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:24:14 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:24:16 dovecot_login authenticator failed for H=(OIc78rr1) [193.26.115.228]:61676: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2026-01-31 04:24:18 dovecot_login authenticator failed for H=([87.229.254.207]) [87.229.254.207]:57336: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:25:52 dovecot_login authenticator failed for H=(dOQXw9) [185.230.124.69]:59454: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:25:05 dovecot_login authenticator failed for H=(yWDS4cWmdH) [185.230.124.69]:62548: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 193.26.115.228
country_id: 6252001
description:
Jan 31 04:25:12 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account wilson has been locked for the attacker IP 193.26.115.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:25:14 dovecot_login authenticator failed for H=(SLK5cI) [193.26.115.228]:51583: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:25:16 dovecot_login authenticator failed for H=(AP6Da2P) [178.16.54.22]:50150: 535 Incorrect authentication data (set_id=mustapa)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.211.164.12
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/assets/images/index.php||SC:/home/webhost/public_html/assets||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:25:57 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.226
country_id: 1605651
description:
2026-01-31 04:26:51 dovecot_login authenticator failed for H=([49.231.31.226]) [49.231.31.226]:46282: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:26:11 dovecot_login authenticator failed for H=(4TEZYxgev) [193.26.115.228]:54370: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:26:18 dovecot_login authenticator failed for H=(GyjRqBgmpT) [185.230.124.69]:59149: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:26:19 dovecot_login authenticator failed for H=(14znCQnfw) [178.16.54.22]:58104: 535 Incorrect authentication data (set_id=mustapa)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:26:22 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: gagasanteguh.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home2/gagasanteguhcom/public_html/wp-content||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:27:13 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:27:08 dovecot_login authenticator failed for H=(n4IPpTGx) [193.26.115.228]:57549: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:27:09 dovecot_login authenticator failed for H=(jFUh2p) [185.230.124.69]:61549: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:27:10 dovecot_login authenticator failed for H=(3VpXaMi8j) [178.16.54.22]:62312: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.163.252.244
country_id: 1814991
description:
2026-01-31 04:27:19 dovecot_login authenticator failed for H=([220.163.252.244]) [220.163.252.244]:60329: 535 Incorrect authentication data (set_id=editor@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-31 04:27:34 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:40942: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.195.7
country_id: 1814991
description:
2026-01-31 04:27:01 dovecot_login authenticator failed for H=([125.69.195.7]) [125.69.195.7]:58324: 535 Incorrect authentication data (set_id=amir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-31 04:28:14 dovecot_login authenticator failed for H=(c0ciE24A) [178.16.54.22]:64946: 535 Incorrect authentication data (set_id=paul.wong)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:28:28 dovecot_login authenticator failed for H=(kMpHwnbe6) [185.230.124.69]:64771: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:28:06 dovecot_login authenticator failed for H=(yxJ0sPZtkG) [193.26.115.228]:61145: 535 Incorrect authentication data (set_id=wilson)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.194.148
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/index.php||SC:/home2/cofrethcom/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:28:03 dovecot_login authenticator failed for H=(icbN3gBtL5) [185.230.124.69]:59995: 535 Incorrect authentication data (set_id=enquiry@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 31 04:28:23 sv3 auth[2797995]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account ernest has been locked for the attacker IP 185.230.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.26.115.228
country_id: 6252001
description:
2026-01-31 04:29:04 dovecot_login authenticator failed for H=(qHeuesYKd) [193.26.115.228]:50795: 535 Incorrect authentication data (set_id=wilson)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.208.80.64
country_id: 1819730
domain: mail.ahfengineering.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/ahfe3522/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-31 04:29:15 dovecot_login authenticator failed for H=(y4NGbv7) [185.230.124.69]:58588: 535 Incorrect authentication data (set_id=ernest)


