# incident

plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:09:11 H=(185.93.89.63) [185.93.89.63]:52877 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <czakowski@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:09:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:09:50 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "POST /cpsess5661732796/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:09:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54938: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:09:11 dovecot_login authenticator failed for H=(qUZyvYBu) [178.16.52.139]:62533: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:10:22 H=(185.93.89.63) [185.93.89.63]:53147 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kevinn@steffian.com>: The mail server could not deliver mail to kevinn@steffian.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:10:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63322: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:10:08 dovecot_login authenticator failed for H=(tVc0mHBe) [77.83.39.61]:65301: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-02-02 22:10:23 dovecot_login authenticator failed for H=([61.97.17.208]) [61.97.17.208]:51833: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:10:22 dovecot_login authenticator failed for H=(l6TZvIKBo) [141.98.11.11]:51138: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-02 22:10:37 dovecot_login authenticator failed for H=(nBARB26) [146.70.146.50]:65198: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2026-02-02 22:10:40 dovecot_login authenticator failed for H=([1.82.135.154]) [1.82.135.154]:58293: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-02-02 22:10:46 dovecot_login authenticator failed for H=([152.52.238.54]) [27.123.92.202]:40892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:10:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:10:18 dovecot_login authenticator failed for H=(U9gEzA) [165.154.252.84]:63961: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:10:45 dovecot_login authenticator failed for H=(LebMUYjL) [77.83.39.61]:54103: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:10:07 dovecot_login authenticator failed for H=(WtPS6rIxk) [178.16.52.139]:57764: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:11:26 H=(185.93.89.63) [185.93.89.63]:53564 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <bob@ffcocpa.com>: The mail server could not deliver mail to bob@ffcocpa.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:11:42 dovecot_login authenticator failed for H=(SDwkkSJbUB) [77.83.39.61]:62757: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:11:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:11:03 dovecot_login authenticator failed for H=(S62phQeW) [178.16.52.139]:59757: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:11:04 dovecot_login authenticator failed for H=(LaWEXdu9Mk) [77.83.39.61]:49977: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:11:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58707: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:11:15 dovecot_login authenticator failed for H=(8e6W4O) [165.154.252.84]:58341: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:11:25 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52438: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:11:27 dovecot_login authenticator failed for H=(OJ75V5iC) [141.98.11.11]:61921: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:12:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:12:10 dovecot_login authenticator failed for H=(LAWf8w) [141.98.11.11]:62741: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.35.207.204
country_id: 1168579
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/DSC02001.png HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-02 22:12:19 dovecot_login authenticator failed for H=(Unpn9Qf6Xy) [146.70.146.50]:49535: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-02-02 22:12:53 H=([77.83.39.188]) [77.83.39.188]:42944 F=<jaya@ktlog.com.my> rejected RCPT <jaya@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:12:29 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:12:37 dovecot_login authenticator failed for H=(vqFq3UjwT) [77.83.39.61]:65506: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:12:03 dovecot_login authenticator failed for H=(h5U21MxW1) [77.83.39.61]:51916: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:12:11 H=(185.93.89.63) [185.93.89.63]:53662 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <cchapman@harmonylabs.com>: The mail server could not deliver mail to cchapman@harmonylabs.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:12:12 dovecot_login authenticator failed for H=(8OGN52Z) [165.154.252.84]:54177: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.54
country_id: 1733045
description:
2026-02-02 22:12:17 dovecot_login authenticator failed for H=([49.124.151.54]) [49.124.151.54]:41368: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.12.90
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/01simple-download-xls.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:12:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52737: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:12:29 dovecot_login authenticator failed for H=(dYH4cZS77j) [178.16.52.139]:64536: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:13:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:13:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 22:13:27 316246 [Warning] Aborted connection 316246 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 22:13:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:13:04 H=(185.93.89.63) [185.93.89.63]:53777 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sshaker@hometownautoretailers.com>: The mail server could not deliver mail to sshaker@hometownautoretailers.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-02-02 22:13:47 H=([91.92.240.254]) [91.92.240.254]:62481 F=<enquiry@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:13:03 dovecot_login authenticator failed for H=(ZRn63M) [141.98.11.11]:64679: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:13:09 dovecot_login authenticator failed for H=(oi0XbN) [165.154.252.84]:50775: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.146.50
country_id: 2782113
description:
2026-02-02 22:13:08 dovecot_login authenticator failed for H=(xVbwke) [146.70.146.50]:59098: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:13:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59038: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:13:20 dovecot_login authenticator failed for H=(7B77a8lqj) [178.16.52.139]:53402: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:13:24 dovecot_login authenticator failed for H=(DwPH1c06) [77.83.39.61]:58173: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:13:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49366: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:13:06 dovecot_login authenticator failed for H=(SxGUyYA) [77.83.39.61]:56841: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:13:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:14:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:14:15 dovecot_login authenticator failed for H=(EjFshedFRR) [178.16.52.139]:64613: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:14:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:14:15 dovecot_login authenticator failed for H=(kyiSx88Ji0) [77.83.39.61]:60456: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.30.21
country_id: 1562822
description:
2026-02-02 22:14:29 dovecot_login authenticator failed for H=([27.71.30.21]) [27.71.30.21]:24321: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:14:31 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 22:14:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:14:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:14:09 dovecot_login authenticator failed for H=(nGsUGzSmR) [77.83.39.61]:58378: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:14:03 dovecot_login authenticator failed for H=(U3uikh8) [141.98.11.11]:65206: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:14:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52603: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:14:05 dovecot_login authenticator failed for H=(Eir4Ut2Qhj) [165.154.252.84]:50076: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:15:05 dovecot_login authenticator failed for H=(gewA0bPHh) [77.83.39.61]:54652: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:15:12 dovecot_login authenticator failed for H=(6GMGKV8M) [178.16.52.139]:54625: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 22:15:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:15:23 dovecot_login authenticator failed for H=(eNtfJX) [141.98.11.11]:57252: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:15:02 dovecot_login authenticator failed for H=(7L05ph6KAT) [165.154.252.84]:63920: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:15:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.117
country_id: 3175395
description:
2026-02-02 22:15:04 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.117]:51110: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:15:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62201: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:15:07 dovecot_login authenticator failed for H=(oG17quU) [77.83.39.61]:62693: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:15:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:15:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:16:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account apm1 has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:16:28 dovecot_login authenticator failed for H=(uxwg94F) [141.98.11.11]:60772: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.186
country_id: 3686110
description:
2026-02-02 22:16:42 dovecot_login authenticator failed for H=([127.0.0.1]) [45.167.250.186]:47321: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:16:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46526: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.187.4.62
country_id: 1733045
description:
[2026-02-02 22:16:12 +0800] info [webmaild] 210.187.4.62 - admin3@tst-ma.com "GET /cpsess3589820086/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:16:34 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:16:57 dovecot_login authenticator failed for H=(LwiF9P) [77.83.39.61]:61105: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:16:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.111.58
country_id: 1269750
description:
2026-02-02 22:16:35 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.111.58]:51268: 535 Incorrect authentication data (set_id=art@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:16:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49663: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:16:03 dovecot_login authenticator failed for H=(lIR31tA) [77.83.39.61]:58261: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:16:16 dovecot_login authenticator failed for H=(m0ZLRlmhQG) [165.154.252.84]:59943: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 22:16:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:16:27 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:16:29 dovecot_login authenticator failed for H=(dLO4V6XkM) [178.16.52.139]:51839: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:17:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:17:43 dovecot_login authenticator failed for H=(LbxVOLX) [141.98.11.11]:51682: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:17:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:17:06 dovecot_login authenticator failed for H=(0J9jQL8dfH) [77.83.39.61]:50974: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:17:08 dovecot_login authenticator failed for H=(adb3Sd) [178.16.52.139]:61731: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:17:13 dovecot_login authenticator failed for H=(GcFENo) [165.154.252.84]:59198: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:17:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55137: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:17:43 dovecot_login authenticator failed for H=(KwQuk39) [77.83.39.61]:59091: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:18:00 H=(185.93.89.63) [185.93.89.63]:54771 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <wincnl01@students.ipfw.edu>: The mail server could not deliver mail to wincnl01@students.ipfw.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:18:14 H=(185.93.89.63) [185.93.89.63]:54801 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <pmarkowitz@protient.com>: The mail server could not deliver mail to pmarkowitz@protient.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:18:23 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48996: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:18:33 dovecot_login authenticator failed for H=(LrWuOT) [77.83.39.61]:53239: 535 Incorrect authentication data (set_id=fadilah)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.183.69.134
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/MockObject/Matcher/ HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:18:10 dovecot_login authenticator failed for H=(AVUXUYw) [77.83.39.61]:52215: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:18:18 dovecot_login authenticator failed for H=(xLyn7Pn) [141.98.11.11]:49702: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:18:26 dovecot_login authenticator failed for H=(JgiwUMC) [178.16.52.139]:51451: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.127.206
country_id: 290557
description:
2026-02-02 22:18:40 dovecot_plain authenticator failed for H=(veled) [94.202.127.206]:53388: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.171.206.122
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/MockObject/Matcher HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:18:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:18:10 dovecot_login authenticator failed for H=(WMVhfI) [165.154.252.84]:57340: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:18:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52737: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/apache2.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:19:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64389: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-02 22:19:13 dovecot_plain authenticator failed for H=(ovemic) [102.53.15.180]:42683: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:19:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:19:16 dovecot_login authenticator failed for H=(kPxnghwhhs) [178.16.52.139]:60365: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 22:19:17 dovecot_plain authenticator failed for H=(polly) [154.144.243.93]:33428: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:19:26 dovecot_login authenticator failed for H=(uhcoHHXWM) [77.83.39.61]:56091: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:19:02 dovecot_login authenticator failed for H=(soE9Zxu) [141.98.11.11]:63884: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:19:06 dovecot_login authenticator failed for H=(34OzrwQ) [77.83.39.61]:64085: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:19:07 dovecot_login authenticator failed for H=(Fh0ho2As) [165.154.252.84]:52897: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:19:42 H=(185.93.89.63) [185.93.89.63]:54998 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sherry.lust@duluth.k12.mn.us>: The mail server could not deliver mail to sherry.lust@duluth.k12.mn.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:20:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:20:20 dovecot_login authenticator failed for H=(goPqbXPx) [77.83.39.61]:58722: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:20:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58151: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:20:42 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48422: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.215.103
country_id: 3144096
description:
2026-02-02 22:20:26 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.215.103]:32901: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:20:04 dovecot_login authenticator failed for H=(KSUeqs) [165.154.252.84]:65115: 535 Incorrect authentication data (set_id=apm1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.142.5
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=14 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:20:03 dovecot_login authenticator failed for H=(2ClkT6Pfnc) [77.83.39.61]:56519: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:20:06 dovecot_login authenticator failed for H=(buCey7c) [178.16.52.139]:60043: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:20:10 dovecot_login authenticator failed for H=(ryplAER) [141.98.11.11]:57860: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.9.83
country_id: 2077456
description:
2026-02-02 22:20:38 dovecot_login authenticator failed for H=([127.0.0.1]) [120.157.9.83]:36668: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:21:21 dovecot_login authenticator failed for H=(eZoP8KeG) [141.98.11.11]:64567: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:21:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52279: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:21:56 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:21:28 dovecot_login authenticator failed for H=(t0gb4Gx) [178.16.52.139]:58094: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 22:21:07 316501 [Warning] Aborted connection 316501 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/screen.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:21:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:21:15 dovecot_login authenticator failed for H=(vIHi2k) [77.83.39.61]:55881: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:21:07 dovecot_login authenticator failed for H=(aw75uhc) [77.83.39.61]:54923: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:22:50 dovecot_login authenticator failed for H=(ATAt6VzZ1) [77.83.39.61]:56950: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 22:22:59 dovecot_plain authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:53567: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:23:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46322: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:22:14 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:22:22 dovecot_login authenticator failed for H=(1BKd0h) [178.16.52.139]:63830: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:22:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64376: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:22:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:22:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:22:09 dovecot_login authenticator failed for H=(MKudFnJl) [77.83.39.61]:58615: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:22:24 dovecot_login authenticator failed for H=(qK0hTq) [141.98.11.11]:52487: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/provision.conf||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:23:46 dovecot_login authenticator failed for H=(msyripa7Q) [77.83.39.61]:59835: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:23:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:23:11 H=(185.93.89.63) [185.93.89.63]:55745 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <mbrockman@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:23:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58983: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:23:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah@pspoly.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:23:05 dovecot_login authenticator failed for H=(ufjWNg) [77.83.39.61]:51742: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.90
country_id: 1269750
description:
2026-02-02 22:23:41 dovecot_login authenticator failed for H=([182.95.26.141]) [125.23.237.90]:54272: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.67.122.230
country_id: 1835841
description:
2026-02-02 22:23:51 dovecot_login authenticator failed for H=([220.67.122.230]) [220.67.122.230]:60173: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:23:58 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:23:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:23:33 dovecot_login authenticator failed for H=(KW6G0FLwF) [141.98.11.11]:55451: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 22:23:05 dovecot_login authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:53567: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/var.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:23:16 dovecot_login authenticator failed for H=(0cWJW0UxD) [178.16.52.139]:61731: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:24:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah@pspoly.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:24:06 dovecot_login authenticator failed for H=(y84R28lxU1) [141.98.11.11]:54155: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:24:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55350: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:24:37 dovecot_login authenticator failed for H=(sIdcMm) [77.83.39.61]:57452: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:24:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:24:10 dovecot_login authenticator failed for H=(SQAcdFw) [178.16.52.139]:52061: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:24:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:24:04 dovecot_login authenticator failed for H=(wr8Sjdt1u) [77.83.39.61]:63064: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/libselinux.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:25:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:25:08 dovecot_login authenticator failed for H=(L2s9vJ6rd4) [77.83.39.61]:63831: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:25:15 dovecot_login authenticator failed for H=(exi81UVMdA) [141.98.11.11]:64585: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:25:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45740: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:25:32 dovecot_login authenticator failed for H=(acjfv7) [77.83.39.61]:51361: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.173
country_id: 2635167
description:
2026-02-02 22:25:45 316828 [Warning] Aborted connection 316828 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.173' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/pcp-conf.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:25:41 H=(185.93.89.63) [185.93.89.63]:56258 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <pat@nda4u.com>: The mail server could not deliver mail to pat@nda4u.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.215.174.140
country_id: 1643084
domain: smartcable.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68961.smartcable.com.my||ServerName:smartcable.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07c1d8e93c2a2f526959a13fe505b93dcb57ea50||Title:0x63f3528a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:25:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:25:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65501: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:25:23 dovecot_login authenticator failed for H=(lRwwPR) [178.16.52.139]:60921: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:25:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah@pspoly.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:26:28 H=(185.93.89.63) [185.93.89.63]:56473 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<admin@ketcauthep.com> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <jrdickerson@apacmail.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2026-02-02 22:26:30 dovecot_login authenticator failed for H=([60.216.89.122]) [60.216.89.122]:43702: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-02-02 22:26:40 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:48426: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:26:41 H=(185.93.89.63) [185.93.89.63]:56560 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <russ.bell@investfinancial.com>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:26:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:26:04 dovecot_login authenticator failed for H=(SZeRZknRql) [77.83.39.61]:59234: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 22:26:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account plant@krisfood.com has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:26:18 dovecot_login authenticator failed for H=(EHl0NT) [141.98.11.11]:56797: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 22:26:15 dovecot_login authenticator failed for H=(fhkCN26v2v) [178.16.52.139]:55908: 535 Incorrect authentication data (set_id=plant@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:26:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59543: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-02-02 22:26:35 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:44800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:26:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah@pspoly.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/systemd-journal.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.75
country_id: 2186224
description:
2026-02-02 22:26:22 dovecot_login authenticator failed for H=([121.73.162.75]) [121.73.162.75]:58924: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:26:23 dovecot_login authenticator failed for H=(rgEovPllY) [77.83.39.61]:57734: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:27:04 dovecot_login authenticator failed for H=(ukPijA) [77.83.39.61]:64736: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:27:08 dovecot_login authenticator failed for H=(IcR1qF5LS) [77.83.39.61]:61539: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:27:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:27:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53821: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:27:22 dovecot_login authenticator failed for H=(Ue1D0q) [141.98.11.11]:53459: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:27:51 H=(185.93.89.63) [185.93.89.63]:56757 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<admin@ketcauthep.com> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mvalentin@professionalaccess.com>: The mail server could not deliver mail to mvalentin@professionalaccess.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.98.95.119
country_id: 3469034
domain: solidfence.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:71228.solidfence.com.my||ServerName:solidfence.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc47c88952dee9aa891771621b41e45c762fabbb||Title:0x00718d13||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/namespace.conf||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.138.88.10
country_id: 192950
domain: solidfence.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11014.solidfence.com.my||ServerName:solidfence.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e72916b8b1e13151f744777b4f404443d2530ea||Title:0x13e7d711||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:27:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah@pspoly.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:27:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35448: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:28:54 dovecot_login authenticator failed for H=(kJxFuT) [77.83.39.61]:56604: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:28:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64267: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:28:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysctl.d/50-coredump.conf||User:root||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:28:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah@pspoly.com.my has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:28:35 dovecot_login authenticator failed for H=(j8eboNB8q7) [141.98.11.11]:64920: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:28:03 dovecot_login authenticator failed for H=(jWuP3OWOi) [77.83.39.61]:50142: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:29:32 H=(185.93.89.63) [185.93.89.63]:56993 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <durfee@touchet.org>: The mail server could not deliver mail to durfee@touchet.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:29:49 dovecot_login authenticator failed for H=(kSV984X) [77.83.39.61]:60393: 535 Incorrect authentication data (set_id=chewkc)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/sepermit.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:29:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58025: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:29:10 dovecot_login authenticator failed for H=(Ec9MYFlEVX) [77.83.39.61]:56207: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:29:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 22:29:29 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:60042: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:29:07 dovecot_login authenticator failed for H=(wFt2dP8) [141.98.11.11]:51570: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:29:19 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:30:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57052: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-02-02 22:30:23 H=([77.83.39.188]) [77.83.39.188]:53292 F=<stacy@ktlog.com.my> rejected RCPT <stacy@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:30:05 dovecot_login authenticator failed for H=(eaU5zUH) [77.83.39.61]:53760: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:30:42 dovecot_login authenticator failed for H=(bTeMGSa) [77.83.39.61]:56158: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:30:09 dovecot_login authenticator failed for H=(YpLsONb8) [141.98.11.11]:58919: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:30:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:30:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52549: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/trusted-key.key||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-02-02 22:30:55 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:48352: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-02-02 22:31:03 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:44403: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:31:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.55
country_id: 2635167
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/js/all.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:31:19 dovecot_login authenticator failed for H=(raIdro) [141.98.11.11]:62331: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.102.123.121
country_id: 1168579
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/awards.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:31:05 dovecot_login authenticator failed for H=(dehHEO) [77.83.39.61]:60446: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:31:27 dovecot_login authenticator failed for H=(RJ59RhtGM) [77.83.39.61]:57251: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 54.167.114.127
country_id: 6252001
domain: box.wohcheong.com.my
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:7.71||T:APACHE||SC:/home2/woh/box.com.my/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:31:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49813: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 22:31:15 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:61965: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.95
country_id: 2635167
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/js/smooth.scroll.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:31:22 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:31:12 H=(185.93.89.63) [185.93.89.63]:57431 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <pedwards@coastal.org>: The mail server could not deliver mail to pedwards@coastal.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.119
country_id: 2635167
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/js/home.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:32:23 dovecot_login authenticator failed for H=(gFRDQdn) [77.83.39.61]:65159: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:32:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55979: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:32:29 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33638: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:32:04 dovecot_login authenticator failed for H=(71RmkB4) [77.83.39.61]:51455: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:32:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:32:33 dovecot_login authenticator failed for H=(ipHhTuBNG) [141.98.11.11]:57946: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:33:08 dovecot_login authenticator failed for H=(lyTCX6Lv) [141.98.11.11]:60944: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:33:11 dovecot_login authenticator failed for H=(Z4e1secQUb) [77.83.39.61]:62090: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:33:47 H=(185.93.89.63) [185.93.89.63]:57900 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tom.tomlinson@marcsone.com>: The mail server could not deliver mail to tom.tomlinson@marcsone.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:33:15 dovecot_login authenticator failed for H=(1QpAXZo) [77.83.39.61]:51202: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:33:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65533: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2026-02-02 22:33:43 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [117.2.123.19]:58290: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/lib/imunify360/events.db||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:33:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:34:07 dovecot_login authenticator failed for H=(wQnI7DQ) [77.83.39.61]:53120: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:34:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39602: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:34:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2026-02-02 22:34:08 dovecot_login authenticator failed for H=([45.190.86.24]) [45.190.86.24]:44471: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 22:34:15 dovecot_login authenticator failed for H=(ClYuz6bT) [141.98.11.11]:53279: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.124.32
country_id: 1269750
description:
2026-02-02 22:34:28 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.124.32]:42812: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:34:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58000: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-02-02 22:34:03 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [182.95.123.50]:39994: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:34:08 dovecot_login authenticator failed for H=(EW9LeOttZY) [77.83.39.61]:59526: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:35:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:35:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53918: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.148.138
country_id: 732800
description:
2026-02-02 22:35:39 dovecot_plain authenticator failed for H=84-238-148-138.ip.btc-net.bg (mical) [84.238.148.138]:34247: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:35:04 dovecot_login authenticator failed for H=(ZSJfDvx) [77.83.39.61]:50283: 535 Incorrect authentication data (set_id=chewkc)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dnf/plugins/copr.conf||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:35:03 dovecot_login authenticator failed for H=(z4SsmePJ) [77.83.39.61]:62562: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:36:03 dovecot_login authenticator failed for H=(nplrwgsBK) [77.83.39.61]:54753: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:36:42 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:36:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64584: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:36:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:36:03 dovecot_login authenticator failed for H=(vLPcpi8Q) [77.83.39.61]:58776: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:37:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34842: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:37:33 dovecot_login authenticator failed for H=(HRMdMcg) [77.83.39.61]:56242: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:37:49 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61188: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 22:37:09 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:61229: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:37:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:37:14 dovecot_login authenticator failed for H=(U3DhZ9y) [77.83.39.61]:60876: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:37:33 dovecot_login authenticator failed for H=(nKlZAk) [165.154.252.84]:57100: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 22:38:45 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:38:49 dovecot_login authenticator failed for H=(TcKsl07) [77.83.39.61]:61594: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:38:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61188: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-02-02 22:38:31 dovecot_login authenticator failed for H=([125.17.216.185]) [128.185.246.106]:41508: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-02-02 22:38:40 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12157: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.199.44.215
country_id: 2750405
description:
Feb  2 22:38:08 sv3 pure-ftpd[2296343]: (?@128.199.44.215) [INFO] New connection from 128.199.44.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:38:10 dovecot_login authenticator failed for H=(aB4JEhZw) [77.83.39.61]:55599: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:38:12 dovecot_login authenticator failed for H=(5HBhoS) [165.154.252.84]:61473: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:38:42 H=(185.93.89.63) [185.93.89.63]:58879 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <amysullivan@visi.com>: The mail server could not deliver mail to amysullivan@visi.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 22:38:12 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/limits.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:39:06 dovecot_login authenticator failed for H=(Y4c0IU2dOe) [77.83.39.61]:61165: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.187.231.236
country_id: 953987
description:
2026-02-02 22:39:20 dovecot_login authenticator failed for H=([41.149.42.161]) [105.187.231.236]:36098: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:39:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57984: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:39:02 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2026-02-02 22:39:05 dovecot_login authenticator failed for H=([59.27.93.138]) [59.27.93.138]:53034: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/manfotp3/logs/manforce_net.php.error.log||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:39:08 dovecot_login authenticator failed for H=(lytvd4) [165.154.252.84]:56278: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:39:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59424: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:39:30 H=(185.93.89.63) [185.93.89.63]:59002 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<kontakt@tvboenigen.ch> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <hjohnson@deltapetrochem.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:40:05 dovecot_login authenticator failed for H=(IKZCyBU) [165.154.252.84]:52386: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/logs/manforce_net.php.error.log||User:manfotp3||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:40:21 dovecot_login authenticator failed for H=(y06XKR) [77.83.39.61]:62688: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-02-02 22:40:32 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:41445: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:40:59 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:40:02 dovecot_login authenticator failed for H=(Nt7wnZiRv) [77.83.39.61]:53313: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:40:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56715: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:40:13 H=(185.93.89.63) [185.93.89.63]:59098 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <evarga@e-varga.com>: The mail server could not deliver mail to evarga@e-varga.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:40:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-02-02 22:40:57 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [27.72.46.152]:44081: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:42:01 H=(185.93.89.63) [185.93.89.63]:59616 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <gwest@hawkinn.com>: The mail server could not deliver mail to gwest@hawkinn.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:41:15 dovecot_login authenticator failed for H=(yxZ0GaZ) [77.83.39.61]:50204: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:41:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53303: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:41:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38288: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:41:52 dovecot_login authenticator failed for H=(ajzFP6gQg) [77.83.39.61]:64890: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:41:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/systemd/journald.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:41:21 dovecot_login authenticator failed for H=(hEpUkdxr) [165.154.252.84]:50671: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.26.72
country_id: 1814991
description:
2026-02-02 22:42:00 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.26.72]:39320: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:41:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2026-02-02 22:41:22 dovecot_login authenticator failed for H=([178.178.194.192]) [178.178.194.192]:35208: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-02-02 22:41:15 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:39718: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pki/nssdb/key4.db||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:42:18 dovecot_login authenticator failed for H=(ORFG7wjge3) [165.154.252.84]:62391: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 22:42:48 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:42:57 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:42:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:42:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:42:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49942: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.244.95.49
country_id: 660013
description:
2026-02-02 22:42:09 dovecot_login authenticator failed for H=([127.0.0.1]) [195.244.95.49]:36258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:42:11 dovecot_login authenticator failed for H=(ogE6VaC) [77.83.39.61]:55455: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.183.135.88
country_id: 2017370
description:
2026-02-02 22:42:47 dovecot_login authenticator failed for H=host.46-183-135-88.broadband.redcom.ru [46.183.135.88]:50319: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:43:07 dovecot_login authenticator failed for H=(eFCXBnrt2) [77.83.39.61]:54988: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:43:14 dovecot_login authenticator failed for H=(pbHD8h2k) [165.154.252.84]:57514: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/storage.log||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:43:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:43:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54452: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:43:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:44:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57812: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:43:08 dovecot_login authenticator failed for H=(uc5a9Yb) [77.83.39.61]:58883: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:43:28 H=(185.93.89.63) [185.93.89.63]:59813 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <travis.pregent@veritude.com>: The mail server could not deliver mail to travis.pregent@veritude.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pure-ftpd.conf||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:44:39 dovecot_login authenticator failed for H=(jyblKA) [77.83.39.61]:64832: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.62.213.214
country_id: 6252001
description:
2026-02-02 22:44:53 dovecot_plain authenticator failed for H=c-24-62-213-214.hsd1.ct.comcast.net (patingly) [24.62.213.214]:37896: 535 Incorrect authentication data (set_id=sales2@ocned.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:44:56 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.44.199
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-column-2.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:44:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52410: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.148.138
country_id: 732800
description:
2026-02-02 22:44:08 dovecot_plain authenticator failed for H=84-238-148-138.ip.btc-net.bg (cistly) [84.238.148.138]:54235: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:44:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-02-02 22:44:55 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:56360: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-02-02 22:44:04 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (dacentie) [73.13.220.220]:54454: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-02-02 22:44:36 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:42006: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:44:03 dovecot_login authenticator failed for H=(x5Fotx) [77.83.39.61]:62692: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:44:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:44:11 dovecot_login authenticator failed for H=(kYVYqc9) [165.154.252.84]:54587: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:44:07 H=(185.93.89.63) [185.93.89.63]:59904 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <nkishore@srgamerica.com>: The mail server could not deliver mail to nkishore@srgamerica.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:45:09 H=(185.93.89.63) [185.93.89.63]:60065 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <hbeltz@workriteaerostar.com>: The mail server could not deliver mail to hbeltz@workriteaerostar.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:45:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57828: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/ks-script-p02p212_.log||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:45:07 dovecot_login authenticator failed for H=(0aTBWeUg) [165.154.252.84]:49671: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:45:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:45:16 dovecot_login authenticator failed for H=(x2Gy8lk6n) [77.83.39.61]:51920: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:46:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:46:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52472: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:46:04 dovecot_login authenticator failed for H=(FaZ25Y3gi) [165.154.252.84]:60051: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:46:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59072: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 22:46:17 +0800] info [cpaneld] 185.204.54.153 - mckd "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:46:18 H=(185.93.89.63) [185.93.89.63]:60390 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ptrompak@gtsolar.com>: The mail server could not deliver mail to ptrompak@gtsolar.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/mail/dovecot.mailbox.log||User:manfotp3||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 22:46:11 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:46:12 dovecot_login authenticator failed for H=(g1GgVjNRg) [77.83.39.61]:54615: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:46:12 dovecot_login authenticator failed for H=(h9L8ADwBF) [77.83.39.61]:53377: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:46:52 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-02 22:47:03 dovecot_plain authenticator failed for H=(tolymp) [176.113.155.132]:34558: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:47:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65161: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.26
country_id: 1733045
description:
2026-02-02 22:47:35 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.149.26]:33630: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:47:19 dovecot_login authenticator failed for H=(DmMXMtzo) [165.154.252.84]:60341: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2026-02-02 22:47:19 dovecot_login authenticator failed for H=([183.236.130.182]) [183.236.130.182]:57783: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:47:29 dovecot_login authenticator failed for H=(F2osmhe) [77.83.39.61]:56679: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.68.100
country_id: 1814991
description:
2026-02-02 22:47:04 dovecot_login authenticator failed for H=([171.217.68.100]) [171.217.68.100]:46338: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.15.17.124
country_id: 1814991
description:
2026-02-02 22:47:50 dovecot_login authenticator failed for H=([127.0.0.1]) [27.15.17.124]:53659: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:47:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:47:08 dovecot_login authenticator failed for H=(Rs5EIA) [77.83.39.61]:52575: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:48:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:48:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58979: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:48:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33414: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.90.185.44
country_id: 2921044
description:
2026-02-02 22:48:38 H=([77.90.185.44]) [77.90.185.44]:63179 F=<mail@cottondreams.org> rejected RCPT <myloo@euratech.com.my>: Mail to myloo@euratech.com.my has been suspended


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:48:46 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:48:53 H=(185.93.89.63) [185.93.89.63]:60822 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <praful.chins@maxonfurniture.com>: The mail server could not deliver mail to praful.chins@maxonfurniture.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:48:05 dovecot_login authenticator failed for H=(lAP9sY) [77.83.39.61]:60836: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:48:16 dovecot_login authenticator failed for H=(WgOlImBzc) [165.154.252.84]:57435: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:49:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 22:49:39 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-02-02 22:49:47 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:58282: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:49:03 dovecot_login authenticator failed for H=(lt9PoD) [77.83.39.61]:62151: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:49:04 dovecot_login authenticator failed for H=(QBnust) [77.83.39.61]:61574: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-02 22:49:05 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:48690: 535 Incorrect authentication data (set_id=info@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:49:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50797: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:49:12 dovecot_login authenticator failed for H=(4aNqecazs) [165.154.252.84]:52495: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-02-02 22:50:01 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:46824: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:50:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:50:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 150.129.166.214
country_id: 1269750
domain: stillman.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30674.stillman.my||ServerName:stillman.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd01b8a88d59d61afa5e7027f522a0604ca75caa||Title:0xfe0726e0||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:50:37 dovecot_login authenticator failed for H=(Xpj6Gn2Yzl) [77.83.39.61]:65074: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:50:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64010: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:50:08 dovecot_login authenticator failed for H=(EICqQQ) [165.154.252.84]:64560: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:50:44 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:50:18 dovecot_login authenticator failed for H=(EiAH9Kd) [77.83.39.61]:53683: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:50:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55092: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.224.38.195
country_id: 1269750
domain: thinkcloud.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/m.php||SC:/home2/thinkcloudadmin/public_html/images/m.php||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:51:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:51:14 dovecot_login authenticator failed for H=(V4OIvWgXy) [77.83.39.61]:60060: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.126.26
country_id: 1269750
description:
2026-02-02 22:51:30 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.126.26]:40948: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.225.31
country_id: 2017370
description:
2026-02-02 22:51:37 dovecot_login authenticator failed for H=([127.0.0.1]) [37.235.225.31]:32986: 535 Incorrect authentication data (set_id=wanfazris)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.224.38.195
country_id: 1269750
domain: thinkcloud.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/thinkcloudadmin/public_html/wp-includes||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:51:05 dovecot_login authenticator failed for H=(FYFT8m) [165.154.252.84]:60108: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:51:54 dovecot_login authenticator failed for H=(P9pngo) [77.83.39.61]:53312: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:51:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59582: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-02-02 22:51:58 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:41414: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:51:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:51:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:52:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55147: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:52:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:52:43 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:53:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55514: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:52:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-02-02 22:52:12 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:57215: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:52:12 dovecot_login authenticator failed for H=(5OcPgqS) [77.83.39.61]:58828: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:52:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:52:20 dovecot_login authenticator failed for H=(FxpOOUIl) [165.154.252.84]:58375: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:53:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61208: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:53:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:53:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:53:09 dovecot_login authenticator failed for H=(Swwch1RD8S) [77.83.39.61]:49395: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 22:53:10 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:53:16 dovecot_login authenticator failed for H=(HN0YAS) [165.154.252.84]:54040: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:53:29 dovecot_login authenticator failed for H=(aJJCLIMx) [77.83.39.61]:62944: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:54:14 dovecot_login authenticator failed for H=(pn2xiSF) [165.154.252.84]:50304: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-02-02 22:54:28 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (pulte) [69.142.126.37]:48348: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:54:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50378: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:54:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account fadilah has been temporarily locked by Imunify PAM(77.83.39.61)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:54:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:54:06 dovecot_login authenticator failed for H=(BLH6HxUWYm) [77.83.39.61]:57098: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:55:02 dovecot_login authenticator failed for H=(kZM1he) [77.83.39.61]:59588: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:55:04 dovecot_login authenticator failed for H=(ygKDChVU5d) [77.83.39.61]:62279: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:55:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:55:30 H=(185.93.89.63) [185.93.89.63]:62118 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jwestervelt@mtmua.com>: The mail server could not deliver mail to jwestervelt@mtmua.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.120
country_id: 1814991
description:
2026-02-02 22:55:55 dovecot_login authenticator failed for H=([111.26.95.119]) [111.26.95.120]:38810: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.130.47.7
country_id: 6252001
description:
2026-02-02 22:56:01 dovecot_login authenticator failed for H=(localhost.localdomain) [178.130.47.7]:57341: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.117
country_id: 3175395
description:
2026-02-02 22:55:08 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.117]:49209: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:55:11 dovecot_login authenticator failed for H=(amDpRCI6R) [165.154.252.84]:62198: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.99.127.122
country_id: 1814991
description:
2026-02-02 22:55:41 dovecot_login authenticator failed for H=([114.99.127.122]) [114.99.127.122]:42465: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 22:55:45 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:54664: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:55:14 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46042: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:55:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63471: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.136.133.126
country_id: 2510769
description:
2026-02-02 22:55:42 dovecot_login authenticator failed for H=126.red-2-136-133.staticip.rima-tde.net [2.136.133.126]:57955: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 103.153.211.16
country_id: 1210997
domain: www.pspoly.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/141.0.7390.37 Safari/537.36||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:56:16 dovecot_login authenticator failed for H=(IKSRze) [77.83.39.61]:64164: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-02-02 22:56:17 dovecot_login authenticator failed for H=([128.185.13.33]) [122.184.123.118]:58010: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:56:18 dovecot_login authenticator failed for H=(w3OfX4D) [77.83.39.61]:56188: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 22:56:48 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-02-02 22:56:06 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:58974: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:56:08 dovecot_login authenticator failed for H=(GNVbFGXgB) [165.154.252.84]:58905: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.46.217.46
country_id: 1861060
domain: mkmetal.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/m.php||SC:/home2/mkmetalc/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.112.109.38
country_id: 2328926
description:
2026-02-02 22:56:31 dovecot_login authenticator failed for H=(localhost) [105.112.109.38]:41424: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:56:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57938: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-02-02 22:56:04 dovecot_login authenticator failed for H=(78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:47032: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:56:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:57:05 dovecot_login authenticator failed for H=(zYwvMX) [165.154.252.84]:53903: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:57:12 dovecot_login authenticator failed for H=(fykeynAa) [77.83.39.61]:61041: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:57:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53351: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:57:49 dovecot_login authenticator failed for H=(epqKZaQxiE) [77.83.39.61]:60273: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-02-02 22:57:20 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (conae) [73.197.236.163]:42492: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:57:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56486: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 22:57:06 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:54671: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:57:50 H=(185.93.89.63) [185.93.89.63]:62691 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jim.collum@stahlbodies.com>: The mail server could not deliver mail to jim.collum@stahlbodies.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.120.45
country_id: 732800
description:
2026-02-02 22:58:22 dovecot_plain authenticator failed for H=(unbell) [62.73.120.45]:45555: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:58:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49747: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:58:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:58:08 dovecot_login authenticator failed for H=(UIA7BXN44) [77.83.39.61]:50871: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:58:21 dovecot_login authenticator failed for H=(h6pxAada) [165.154.252.84]:53611: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:58:50 H=(185.93.89.63) [185.93.89.63]:62842 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <james.lathsen@palmettohealth.org>: The mail server could not deliver mail to james.lathsen@palmettohealth.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 22:59:18 dovecot_login authenticator failed for H=(3oJ2TYc) [165.154.252.84]:65314: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:59:22 dovecot_login authenticator failed for H=(3dujIrD7lA) [77.83.39.61]:58935: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 22:59:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59975: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 22:59:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 22:59:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39278: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 22:59:04 dovecot_login authenticator failed for H=(ENDxXxz) [77.83.39.61]:49192: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 22:59:05 H=(185.93.89.63) [185.93.89.63]:62862 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rich@richhallrealestate.com>: The mail server could not deliver mail to rich@richhallrealestate.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 22:59:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 22:59:28 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:00:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
country_id: 2661886
description:
2026-02-02 23:00:25 dovecot_login authenticator failed for H=217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:54214: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:01:00 H=(185.93.89.63) [185.93.89.63]:63214 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jeff.hallback@duluth.k12.mn.us>: The mail server could not deliver mail to jeff.hallback@duluth.k12.mn.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2026-02-02 23:00:12 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:55810: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:00:15 dovecot_login authenticator failed for H=(RQsDtQa9) [165.154.252.84]:60478: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:00:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:00:02 dovecot_login authenticator failed for H=(743jiS) [77.83.39.61]:60950: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:00:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54079: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:00:30 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:00:40 dovecot_login authenticator failed for H=(Aii2Ho) [77.83.39.61]:59129: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:01:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:01:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:01:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:01:12 dovecot_login authenticator failed for H=(9MV7um) [165.154.252.84]:56528: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:01:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64601: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:01:15 dovecot_login authenticator failed for H=(cB820La) [77.83.39.61]:57110: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.33
country_id: 1733045
description:
2026-02-02 23:01:38 dovecot_login authenticator failed for H=([49.124.153.33]) [49.124.153.33]:50526: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.162.121.31
country_id: 690791
description:
2026-02-02 23:01:55 dovecot_login authenticator failed for H=([81.162.121.31]) [81.162.121.31]:51178: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:02:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:02:16 dovecot_login authenticator failed for H=(z9pevj) [77.83.39.61]:63873: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.168.37
country_id: 3469034
description:
2026-02-02 23:02:58 dovecot_login authenticator failed for H=([127.0.0.1]) [191.59.168.37]:35678: 535 Incorrect authentication data (set_id=sylviagooi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:02:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57074: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:02:09 dovecot_login authenticator failed for H=(6HAoygON) [165.154.252.84]:52031: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:02:14 dovecot_login authenticator failed for H=(vMLIA3wQAV) [77.83.39.61]:63389: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:02:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.24.41
country_id: 1814991
description:
2026-02-02 23:02:50 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.24.41]:52075: 535 Incorrect authentication data (set_id=sylviagooi@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:03:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:03:57 dovecot_login authenticator failed for H=(CqErLIayAS) [77.83.39.61]:53362: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:03:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:03:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61716: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:03:06 dovecot_login authenticator failed for H=(GWkZSowI) [165.154.252.84]:55937: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:03:15 dovecot_login authenticator failed for H=(ZAmLSpT) [77.83.39.61]:50197: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-02-02 23:04:22 dovecot_plain authenticator failed for H=(syceptnest) [154.144.243.93]:42190: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:04:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57959: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:04:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60780: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Feb  2 23:04:14 sv3 pure-ftpd[2315322]: (?@47.84.199.24) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:04:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:04:18 dovecot_login authenticator failed for H=(9bYoA8b) [77.83.39.61]:60721: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:04:13 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:04:03 dovecot_login authenticator failed for H=(YhP8jU2Z) [165.154.252.84]:64974: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:05:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51632: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:05:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:05:18 dovecot_login authenticator failed for H=(1JTVV2vgWJ) [165.154.252.84]:49938: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:05:21 dovecot_login authenticator failed for H=(rxKqGP) [77.83.39.61]:64599: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:05:24 dovecot_login authenticator failed for H=(H1HCge) [77.83.39.61]:54616: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:05:29 H=(185.93.89.63) [185.93.89.63]:64072 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rbuck@locinc1.com>: The mail server could not deliver mail to rbuck@locinc1.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:06:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58105: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:07:01 H=(185.93.89.63) [185.93.89.63]:64524 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <erybaltowski@bcbsde.com>: The mail server could not deliver mail to erybaltowski@bcbsde.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:06:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:06:06 dovecot_login authenticator failed for H=(y9SgTE) [77.83.39.61]:60605: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:06:14 dovecot_login authenticator failed for H=(Xz0qgCf37E) [165.154.252.84]:49470: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:06:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35870: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:07:11 dovecot_login authenticator failed for H=(7d1Vd5) [165.154.252.84]:62833: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:07:07 dovecot_login authenticator failed for H=(7JktpmbV) [77.83.39.61]:62691: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:07:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:07:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52941: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.93
country_id: 690791
description:
2026-02-02 23:07:52 H=([77.83.39.93]) [77.83.39.93]:56206 F=<Vanessa.Wang@skf.com> rejected RCPT <eunice.lee@ktlog.com.my>: SPF: 77.83.39.93 is not allowed to send mail from skf.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:07:10 dovecot_login authenticator failed for H=(uWgMllJ) [77.83.39.61]:60933: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.119
country_id: 1814991
description:
2026-02-02 23:07:38 dovecot_login authenticator failed for H=([111.26.106.118]) [111.26.106.119]:54078: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2026-02-02 23:07:54 dovecot_login authenticator failed for H=([116.246.31.172]) [116.246.31.172]:38822: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:07:56 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:08:07 dovecot_login authenticator failed for H=(AUDuU0b1yM) [77.83.39.61]:51222: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:08:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64253: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:08:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:08:08 dovecot_login authenticator failed for H=(ZF7JCg) [165.154.252.84]:49779: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:08:47 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55268: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:08:48 dovecot_login authenticator failed for H=(IggFeq5IAt) [77.83.39.61]:53562: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:09:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:09:05 dovecot_login authenticator failed for H=(LCp0r1) [165.154.252.84]:64231: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:09:10 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:09:07 dovecot_login authenticator failed for H=(BagKOQ) [77.83.39.61]:62228: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:09:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58943: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-02-02 23:09:14 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (alocaurize) [24.127.53.61]:55762: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:09:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.180.186.63
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=11981514510565 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:10:04 dovecot_login authenticator failed for H=(UrlyNT1Q) [77.83.39.61]:59970: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.248
country_id: 1668284
description:
2026-02-02 23:10:10 dovecot_login authenticator failed for H=111-70-33-248.emome-ip.hinet.net [111.70.33.248]:52452: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.107.196.151
country_id: 2017370
description:
2026-02-02 23:10:46 dovecot_login authenticator failed for H=(ip-217.107.196.151.lipetsk.zelenaya.net) [217.107.196.151]:39920: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:10:21 dovecot_login authenticator failed for H=(h6IoakE) [165.154.252.84]:58187: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:10:30 dovecot_login authenticator failed for H=(3rJ3vtN00l) [77.83.39.61]:60455: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.111.210
country_id: 1835841
description:
2026-02-02 23:10:36 dovecot_login authenticator failed for H=([14.37.111.210]) [14.37.111.210]:41880: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:10:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57981: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:10:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:10:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:11:00 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45756: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:11:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 146.148.12.176
country_id: 2802361
description:
2026-02-02 23:11:33 319813 [Warning] Aborted connection 319813 to db: 'unconnected' user: 'unauthenticated' host: '146.148.12.176' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:11:03 dovecot_login authenticator failed for H=(I6THvwNk) [77.83.39.61]:58484: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:11:18 dovecot_login authenticator failed for H=(xNTW8Q) [165.154.252.84]:52589: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:11:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52800: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:11:51 H=(185.93.89.63) [185.93.89.63]:65508 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <j_norris@chapco-adhesive.com>: The mail server could not deliver mail to j_norris@chapco-adhesive.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:11:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.35.19.230
country_id: 2658434
description:
2026-02-02 23:11:20 dovecot_plain authenticator failed for H=dhclient-212-35-19-230.flashcable.ch (ronfors) [212.35.19.230]:43878: 535 Incorrect authentication data (set_id=callen@kimmark.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:12:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:12:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54992: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:12:03 dovecot_login authenticator failed for H=(tDaPn4Edf) [77.83.39.61]:51410: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:12:04 dovecot_login authenticator failed for H=(z3PfeZa1I) [77.83.39.61]:54760: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:12:15 H=(185.93.89.63) [185.93.89.63]:49181 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<mpnmjec@mpnmjec.ac.in> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <nyed@wcb.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:12:15 dovecot_login authenticator failed for H=(a8JQRA) [165.154.252.84]:54515: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:13:44 dovecot_login authenticator failed for H=(MPiQbNM4cP) [77.83.39.61]:58193: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:13:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41696: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:13:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51319: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:13:12 dovecot_login authenticator failed for H=(C2vZMd) [165.154.252.84]:51175: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:13:35 H=(185.93.89.63) [185.93.89.63]:49435 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <saikrishna@hi-caliber-it.com>: The mail server could not deliver mail to saikrishna@hi-caliber-it.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:13:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:13:07 dovecot_login authenticator failed for H=(MsWRWI71no) [77.83.39.61]:62527: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:14:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62968: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 23:14:15 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:50789: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:78359.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:af90eff3ca877b75b8cc924dbec0a6dd6b562d46||Title:0xced75860||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:14:05 dovecot_login authenticator failed for H=(90NDVUi) [77.83.39.61]:65050: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:14:09 dovecot_login authenticator failed for H=(Ln1G0vBjF) [165.154.252.84]:55936: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:14:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:15:17 dovecot_login authenticator failed for H=(098aMvVo) [77.83.39.61]:58680: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.162.158.2
country_id: 1814991
description:
2026-02-02 23:15:47 dovecot_login authenticator failed for H=([127.0.0.1]) [124.162.158.2]:53960: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 23:16:01 +0800] info [cpaneld] 185.204.54.153 - evergrow "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user evergrow (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2026-02-02 23:15:13 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:47312: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:15:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:15:24 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.179.171.51
country_id: 1269750
domain: symphony-led.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:41167.symphony-led.com||ServerName:symphony-led.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d153324bb5b587c0ca9834ab3811fa4e833d9e53||Title:0x6d1c96e2||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:15:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57281: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:15:09 dovecot_login authenticator failed for H=(vjTYSXA1) [77.83.39.61]:58041: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:15:34 H=(185.93.89.63) [185.93.89.63]:49718 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <wallender@mediapolis.k12.ia.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.203.175.65
country_id: 1269750
description:
2026-02-02 23:15:55 dovecot_login authenticator failed for H=([127.0.0.1]) [117.203.175.65]:57698: 535 Incorrect authentication data (set_id=munch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:15:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53922: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2026-02-02 23:15:26 dovecot_login authenticator failed for H=([111.171.127.190]) [111.171.127.190]:56475: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:16:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53022: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:16:17 dovecot_login authenticator failed for H=(ksgBH50c5h) [77.83.39.61]:62716: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:16:36 dovecot_login authenticator failed for H=(qwOsssrrb) [77.83.39.61]:54083: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:16:52 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:16:30 H=(185.93.89.63) [185.93.89.63]:49950 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<test@sushmajart.com> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <buzzybee2@bullheadcity-bee.com>: The mail server could not deliver mail to buzzybee2@bullheadcity-bee.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:17:37 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35760: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.185.190
country_id: 1269750
description:
2026-02-02 23:18:00 dovecot_login authenticator failed for H=([182.95.87.220]) [122.185.185.190]:34312: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:17:14 dovecot_login authenticator failed for H=(T88ONhe8FD) [77.83.39.61]:59384: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:17:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63692: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:17:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-02-02 23:17:42 dovecot_login authenticator failed for H=(nsg-static-089.96.71.182.airtel.in) [182.95.181.166]:52484: 535 Incorrect authentication data (set_id=test@wohcheong.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.93
country_id: 690791
description:
2026-02-02 23:17:38 H=([77.83.39.93]) [77.83.39.93]:64084 F=<Vanessa.Wang@skf.com> rejected RCPT <jacklim@ktlog.com.my>: SPF: 77.83.39.93 is not allowed to send mail from skf.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.121.20.182
country_id: 1733045
description:
[2026-02-02 23:17:41 +0800] info [webmaild] 45.121.20.182 - marketing@smartelectro.com.my "POST /cpsess3338980781/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [180.75.72.60] != Current IP Address [45.121.20.182]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:18:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah@pspoly.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:18:11 dovecot_login authenticator failed for H=(fn9LDqhu9t) [77.83.39.61]:60364: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:18:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59040: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-02-02 23:18:45 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:3014: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:18:11 dovecot_login authenticator failed for H=(6uPkDVk) [77.83.39.61]:60225: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-02-02 23:18:54 dovecot_login authenticator failed for H=(red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:52770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:19:36 H=(185.93.89.63) [185.93.89.63]:50621 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <m.galloway@nwnaturalproducts.com>: The mail server could not deliver mail to m.galloway@nwnaturalproducts.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:19:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58668: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:19:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53374: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:19:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:19:32 dovecot_login authenticator failed for H=(cREWxo) [77.83.39.61]:50506: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:19:09 dovecot_login authenticator failed for H=(bXBUEeCOH) [77.83.39.61]:61688: 535 Incorrect authentication data (set_id=fadilah)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.143.144
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=23171523585459 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 23:19:26 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:54275: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:19:29 dovecot_login authenticator failed for H=(y8KVF67ai) [165.154.252.84]:61243: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:20:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65275: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:21:02 dovecot_login authenticator failed for H=(GFbDcF) [77.83.39.61]:57187: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:20:08 dovecot_login authenticator failed for H=(z8kubt5zz) [165.154.252.84]:50229: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-02-02 23:20:17 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp [218.219.193.151]:51153: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.155.88.155
country_id: 2300660
description:
2026-02-02 23:20:25 dovecot_login authenticator failed for H=(88-155-41-155-dedicatedinternet.vodafone.com.gh) [41.155.88.155]:52008: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-02-02 23:20:05 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (cored) [73.195.211.98]:39080: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:20:06 dovecot_login authenticator failed for H=(lRwExq) [77.83.39.61]:59529: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:20:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:20:37 H=(185.93.89.63) [185.93.89.63]:50763 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <lclark@midwestvalveparts.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:21:05 dovecot_login authenticator failed for H=(bXQ7xso) [165.154.252.84]:62987: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:21:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-02-02 23:21:44 dovecot_login authenticator failed for H=([219.248.4.146]) [219.248.4.146]:49326: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.7.78.226
country_id: 2510769
description:
2026-02-02 23:21:54 dovecot_login authenticator failed for H=226.red-88-7-78.staticip.rima-tde.net [88.7.78.226]:34028: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:21:07 dovecot_login authenticator failed for H=(vdzaZSKmv) [77.83.39.61]:50017: 535 Incorrect authentication data (set_id=garylee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:21:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55096: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 37.140.223.49
country_id: 6252001
domain: mymetal.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:cabecom||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:22:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:22:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63307: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:22:20 dovecot_login authenticator failed for H=(n04fZf) [165.154.252.84]:64005: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:22:35 dovecot_login authenticator failed for H=(3M4WHL) [77.83.39.61]:53594: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.19.1.201
country_id: 2017370
description:
2026-02-02 23:22:59 dovecot_login authenticator failed for H=([127.0.0.1]) [94.19.1.201]:54586: 535 Incorrect authentication data (set_id=noreply@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:22:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:22:16 dovecot_login authenticator failed for H=(IefanhnnHZ) [77.83.39.61]:58108: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:23:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:23:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58454: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:23:17 dovecot_login authenticator failed for H=(ddNCtPG) [165.154.252.84]:60475: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:23:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39192: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:23:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.241.206.35
country_id: 2635167
description:
2026-02-02 23:23:05 dovecot_login authenticator failed for H=([127.0.0.1]) [145.241.206.35]:60802: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:23:26 H=(185.93.89.63) [185.93.89.63]:51386 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <schristian@plainfieldprecision.com>: The mail server could not deliver mail to schristian@plainfieldprecision.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:23:56 dovecot_login authenticator failed for H=(cfEuW9LE) [77.83.39.61]:62501: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:23:13 dovecot_login authenticator failed for H=(Ytrcvfw) [77.83.39.61]:52158: 535 Incorrect authentication data (set_id=fadilah)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd79e2bec436e22bf4e535ddd3fed65c26f4fae4||Title:0x26bcaa97||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:24:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53407: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 23:24:40 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:38976: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:24:09 dovecot_login authenticator failed for H=(RjMxhtYF1y) [77.83.39.61]:56856: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:24:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:24:14 dovecot_login authenticator failed for H=(EjxzSz) [165.154.252.84]:57024: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 23:24:27 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:51395: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:24:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2026-02-02 23:25:56 dovecot_login authenticator failed for H=([111.26.67.35]) [111.26.67.36]:33636: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:25:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.77.156
country_id: 1814991
description:
2026-02-02 23:25:19 dovecot_login authenticator failed for H=([223.210.0.110]) [111.48.77.156]:23403: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:25:25 dovecot_login authenticator failed for H=(cegI9K44) [77.83.39.61]:55798: 535 Incorrect authentication data (set_id=fadilah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:25:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.119.64.162
country_id: 3686110
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Matcher/Not.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:25:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38230: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-02-02 23:25:53 dovecot_login authenticator failed for H=([128.185.241.87]) [125.19.206.54]:36944: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:25:05 dovecot_login authenticator failed for H=(66vnIrbSN) [77.83.39.61]:53264: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:25:11 dovecot_login authenticator failed for H=(hN7sPvBY) [165.154.252.84]:54271: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:25:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57650: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2026-02-02 23:25:43 dovecot_login authenticator failed for H=(m121-202-198-98.smartone.com) [121.202.198.98]:36426: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8835addd98bb87bc23bbe0f6a5f6a79c1e31227e||Title:0x71252912||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:26:32 H=(185.93.89.63) [185.93.89.63]:51887 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jonathan.porter@ppww.org>: The mail server could not deliver mail to jonathan.porter@ppww.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:26:02 dovecot_login authenticator failed for H=(fsdG5GLW) [77.83.39.61]:64048: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:26:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50996: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:26:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.187.7.14
country_id: 1835841
description:
2026-02-02 23:26:19 dovecot_login authenticator failed for H=([211.187.7.14]) [211.187.7.14]:34354: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:26:58 dovecot_login authenticator failed for H=(tGP86p7) [77.83.39.61]:59632: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:26:08 dovecot_login authenticator failed for H=(5UyyDIFMq) [165.154.252.84]:51480: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:26:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:36ebfca19accad6cd4affd5dd5602aa22f74aa7a||Title:0xe05cb926||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:27:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61632: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:27:02 dovecot_login authenticator failed for H=(rCQYAHM) [77.83.39.61]:63970: 535 Incorrect authentication data (set_id=garylee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.230.197
country_id: 1880251
domain: tptec.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/tptecadmin/public_html/wp-includes||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:27:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:27:02 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:27:04 dovecot_login authenticator failed for H=(HRE6GJea7L) [165.154.252.84]:64902: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:28:27 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:28:33 H=(185.93.89.63) [185.93.89.63]:52468 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<mpnmjec@mpnmjec.ac.in> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <hgroat@whitepigeonpaper.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:28:43 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33280: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:28:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54363: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:28:13 dovecot_login authenticator failed for H=(BldjlFbEu) [77.83.39.61]:59592: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:28:17 dovecot_login authenticator failed for H=(txOrhs) [77.83.39.61]:56596: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:28:20 dovecot_login authenticator failed for H=(aocy4CgZbe) [165.154.252.84]:64400: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:29:47 dovecot_login authenticator failed for H=(T92zoB1fk) [77.83.39.61]:49357: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:29:17 dovecot_login authenticator failed for H=(O2Zwuj0) [165.154.252.84]:61885: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:29:30 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d739732fcd8fd4ce425498fcf0fe201015bdf12f||Title:0xb9b25c48||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:29:08 H=(185.93.89.63) [185.93.89.63]:52555 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <stephen.foster@ndsu.nodak.edu>: The mail server could not deliver mail to stephen.foster@ndsu.nodak.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:29:08 dovecot_login authenticator failed for H=(wW7en5Fr6) [77.83.39.61]:61522: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:29:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50765: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:29:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:30:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:30:14 dovecot_login authenticator failed for H=(r5NzHyt) [165.154.252.84]:57773: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:30:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:30:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64806: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:30:04 dovecot_login authenticator failed for H=(GhYna1) [77.83.39.61]:62997: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:31:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56162: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:31:19 dovecot_login authenticator failed for H=(T9rVwEvy0) [77.83.39.61]:55359: 535 Incorrect authentication data (set_id=fadilah)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93e80f2483c668d6fc826cab7b6d7cda6c985887||Title:0x5c12e3ca||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:31:11 dovecot_login authenticator failed for H=(3E1Qo6) [165.154.252.84]:54042: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:31:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.167
country_id: 6252001
description:
Feb  2 23:31:37 sv3 pure-ftpd[2336988]: (?@167.94.138.167) [INFO] New connection from 167.94.138.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:31:02 dovecot_login authenticator failed for H=(MrLstqdNqG) [77.83.39.61]:58404: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:31:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2026-02-02 23:31:22 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [179.185.18.67]:37567: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:31:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54268: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:31:31 H=(185.93.89.63) [185.93.89.63]:52910 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <hickeyd@mason.k12.oh.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-02-02 23:31:34 dovecot_login authenticator failed for H=([128.185.13.33]) [122.184.123.118]:43298: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:31:02 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.180.240
country_id: 2017370
description:
2026-02-02 23:32:49 dovecot_login authenticator failed for H=([127.0.0.1]) [90.188.180.240]:65179: 535 Incorrect authentication data (set_id=fudiluh@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:32:45 dovecot_login authenticator failed for H=(fxk4F2A88) [158.94.210.42]:54894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.225.31
country_id: 2017370
description:
2026-02-02 23:32:57 dovecot_login authenticator failed for H=([127.0.0.1]) [37.235.225.31]:41276: 535 Incorrect authentication data (set_id=fudiluh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:32:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64168: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:32:14 dovecot_login authenticator failed for H=(EGDTr3TC) [77.83.39.61]:54762: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:32:23 H=(185.93.89.63) [185.93.89.63]:53145 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <alonzo.strange@co.yuma.az.us>: host lookup did not complete


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:32:35 dovecot_login authenticator failed for H=(Ks2HiEfnM) [77.83.39.61]:56851: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.182.49
country_id: 6252001
description:
2026-02-02 23:32:04 dovecot_login authenticator failed for H=(localhost) [130.12.182.49]:55706: 535 Incorrect authentication data (set_id=ec2-user)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:32:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:32:08 dovecot_login authenticator failed for H=(iqVh94BvNm) [165.154.252.84]:49808: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:32:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:33:09 dovecot_login authenticator failed for H=(LGQVYS) [158.94.210.42]:51614: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:33:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59533: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.154.41
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/images/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4269d74c613458a34a26cf4dcbc253cea6d5452f||Title:0x43d37180||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.169.181
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/version/tests/Unit/VersionTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:33:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:33:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36408: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:33:10 dovecot_login authenticator failed for H=(Q8b5gD) [77.83.39.61]:61642: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.132.94
country_id: 2017370
description:
2026-02-02 23:33:20 dovecot_login authenticator failed for H=([62.182.132.94]) [62.182.132.94]:55246: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-02-02 23:33:29 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:56338: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:33:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:33:03 dovecot_login authenticator failed for H=(maeAtMNFdk) [165.154.252.84]:62209: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:34:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54590: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:34:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account fadilah has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:34:07 dovecot_login authenticator failed for H=(eFwKhdiJ) [158.94.210.42]:57979: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:34:19 dovecot_login authenticator failed for H=(M7K9ltCjGz) [165.154.252.84]:62481: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:34:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza@ktlog.com.my has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:90e83b8d8f2870575d0d0505f03066da5432f073||Title:0x55b1483e||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:34:06 dovecot_login authenticator failed for H=(Eg4Xw8FqqZ) [77.83.39.61]:55452: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:34:06 dovecot_login authenticator failed for H=(NyzucL) [77.83.39.61]:61160: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:35:05 dovecot_login authenticator failed for H=(HwzRUgKd9W) [158.94.210.42]:51894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:35:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:35:40 dovecot_login authenticator failed for H=(WibeiDfboQ) [77.83.39.61]:49925: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:35:03 dovecot_login authenticator failed for H=(ckFNKO7j) [77.83.39.61]:59095: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:35:16 dovecot_login authenticator failed for H=(xpiopgwof) [165.154.252.84]:57341: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:35:28 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59925: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.117
country_id: 1814991
description:
2026-02-02 23:37:02 dovecot_login authenticator failed for H=([111.26.106.117]) [111.26.106.117]:60050: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:36:06 dovecot_login authenticator failed for H=(KJFHr1Po9L) [158.94.210.42]:53744: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:36:13 dovecot_login authenticator failed for H=(m2fGmsZ) [165.154.252.84]:54259: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:36:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.21
country_id: 6252001
description:
2026-02-02 23:36:46 320710 [Warning] Aborted connection 320710 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.21' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:36:54 dovecot_login authenticator failed for H=(f1lU5O) [77.83.39.61]:64989: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:36:17 dovecot_login authenticator failed for H=(KZHk2Kj) [77.83.39.61]:49775: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:36:18 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54248: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6681b470b434f26ee7345b9ae89acbca8ac4b15c||Title:0x0b78ebd8||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:37:04 dovecot_login authenticator failed for H=(9F5LD7C4) [158.94.210.42]:62049: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-02-02 23:37:11 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:50772: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.47.189
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=9 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:37:48 H=(185.93.89.63) [185.93.89.63]:54239 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kika@egovernmentworks.com>: The mail server could not deliver mail to kika@egovernmentworks.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:37:51 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:37:13 dovecot_login authenticator failed for H=(7GuIvuDgH4) [77.83.39.61]:62033: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:37:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64417: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:37:10 dovecot_login authenticator failed for H=(E6e5Onf) [165.154.252.84]:51731: 535 Incorrect authentication data (set_id=juliza@ktlog.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  2 23:37:33 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:38:03 dovecot_login authenticator failed for H=(FIiX4Ai) [158.94.210.42]:53363: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:38:09 dovecot_login authenticator failed for H=(umcdop41YX) [77.83.39.61]:51992: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:38:07 dovecot_login authenticator failed for H=(XJKlKgI35y) [165.154.252.84]:64665: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:40a8f016c51eb4f1e8482f881a78a6a2a7dcd235||Title:0x980692d7||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:38:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58980: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:38:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
country_id: 1814991
description:
2026-02-02 23:39:07 dovecot_login authenticator failed for H=([180.168.60.146]) [180.168.60.146]:39099: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:39:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:39:04 dovecot_login authenticator failed for H=(2kVEMh) [165.154.252.84]:62584: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:39:09 dovecot_login authenticator failed for H=(uvrDHu1U) [158.94.210.42]:64100: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:39:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64103: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:39:05 dovecot_login authenticator failed for H=(icJe9DSZ) [77.83.39.61]:65194: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  2 23:39:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.255.50
country_id: 1269750
description:
2026-02-02 23:39:18 dovecot_login authenticator failed for H=([122.186.255.50]) [122.186.255.50]:49404: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:39:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48272: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:39:47 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:39:50 H=(185.93.89.63) [185.93.89.63]:54634 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rlueckel@fs.fed.us>: The mail server could not deliver mail to rlueckel@fs.fed.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:40:46 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60367: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:40:08 dovecot_login authenticator failed for H=(PMH98U) [158.94.210.42]:62733: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:40:20 dovecot_login authenticator failed for H=(b2dFUdWf) [165.154.252.84]:63066: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:40:20 dovecot_login authenticator failed for H=(PiI5cR0GMv) [77.83.39.61]:55513: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.53.96.229
country_id: 298795
description:
2026-02-02 23:40:34 dovecot_plain authenticator failed for H=server-176.53.96.229.as42926.net (pyerdlen) [176.53.96.229]:41558: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.244.32
country_id: 6252001
description:
[2026-02-02 23:40:42 +0800] info [whostmgrd] 172.58.244.32 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5b305f87b503fa851cb6b0bd195fa27a382a0079||Title:0x1b91e58c||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  2 23:40:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:40:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:41:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56826: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:224182bcf1bc14a384b64de00d0f2f07cfc6cc78||Title:0x8c770fb4||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:41:03 dovecot_login authenticator failed for H=(rc5mbO3LDF) [158.94.210.42]:56804: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:41:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:41:16 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:41:36 dovecot_login authenticator failed for H=(ZkoxiQ) [165.154.252.84]:63182: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:41:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:41:17 dovecot_login authenticator failed for H=(bpXlxl) [165.154.252.84]:59147: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:41:18 dovecot_login authenticator failed for H=(f0L9AgDu) [77.83.39.61]:49225: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:42:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63163: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:42:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:42:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:42:14 dovecot_login authenticator failed for H=(lkK4Npd) [165.154.252.84]:55000: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:42:14 dovecot_login authenticator failed for H=(wKHWX69) [77.83.39.61]:61171: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:42:32 dovecot_login authenticator failed for H=(UIvW26zpXl) [158.94.210.42]:51427: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:42:04 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:49656: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:43:23 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:46a4dc4c4d11db2518686edbefbe59350a335187||Title:0x0bef2029||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:43:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:43:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58274: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:43:13 H=(185.93.89.63) [185.93.89.63]:55325 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kevin.edwards@clearwire.com>: The mail server could not deliver mail to kevin.edwards@clearwire.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:43:15 dovecot_login authenticator failed for H=(zoc8YI2mO) [77.83.39.61]:57899: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:43:11 dovecot_login authenticator failed for H=(br3bt4) [165.154.252.84]:51454: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:43:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee@autogreastar.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 23:43:34 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:56297: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:43:34 dovecot_login authenticator failed for H=(KORb0r4) [158.94.210.42]:61358: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:44:02 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:44:08 dovecot_login authenticator failed for H=(wJuyrfv7) [165.154.252.84]:64812: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:44:11 dovecot_login authenticator failed for H=(SAIdo9ey) [77.83.39.61]:63096: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 200.114.169.214
country_id: 3865483
description:
Feb  2 23:44:56 sv3 pure-ftpd[2347904]: (?@200.114.169.214) [WARNING] Authentication failed for user [angiehng]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 200.114.169.214
country_id: 3865483
description:
Feb  2 23:44:57 sv3 pure-ftpd[2348079]: (?@200.114.169.214) [INFO] New connection from 200.114.169.214


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:44:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  2 23:44:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:44:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46360: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 200.114.169.214
country_id: 3865483
description:
Feb  2 23:44:03 sv3 pure-ftpd[2347264]: (?@200.114.169.214) [INFO] New connection from 200.114.169.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:44:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53469: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 185.93.89.64
country_id: 130758
description:
Feb  2 23:44:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(185.93.89.64)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:44:31 dovecot_login authenticator failed for H=(moaYQd) [158.94.210.42]:60993: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 200.114.169.214
country_id: 3865483
description:
Feb  2 23:44:10 sv3 pure-ftpd[2347264]: (?@200.114.169.214) [WARNING] Authentication failed for user [angiehng@manforce.net]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:45:05 dovecot_login authenticator failed for H=(05TN4J) [165.154.252.84]:61395: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:45:24 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:45:37 dovecot_login authenticator failed for H=(P3FNTmJoD) [158.94.210.42]:59527: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:00f279137e0f77cb891da00e44ce3314953a5373||Title:0xaf64e7ac||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 200.114.169.214
country_id: 3865483
description:
Feb  2 23:45:05 sv3 pure-ftpd[2348079]: (?@200.114.169.214) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:45:07 dovecot_login authenticator failed for H=(Ib9u0AK60P) [77.83.39.61]:59155: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:45:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64610: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  2 23:45:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:45:26 dovecot_login authenticator failed for H=(FRRYvGoC4) [77.83.39.61]:53414: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:45:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 200.114.169.214
country_id: 3865483
description:
Feb  2 23:45:06 sv3 pure-ftpd[2348215]: (?@200.114.169.214) [INFO] New connection from 200.114.169.214


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:45:10 H=(185.93.89.63) [185.93.89.63]:55637 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<mpnmjec@mpnmjec.ac.in> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jeff@cellartoceiling.com>: The mail server could not deliver mail to jeff@cellartoceiling.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/mysql_system_tables_data.sql||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:46:03 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:46:11 dovecot_login authenticator failed for H=(MXhG1RAC) [158.94.210.42]:53463: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:46:19 H=(185.93.89.63) [185.93.89.63]:55785 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <jsimmons@iphase.com>: host lookup did not complete


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:652dbbcc28c6dded11cecfe7e728d2d189238c36||Title:0x82ec40a9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.114.169.214
country_id: 3865483
description:
2026-02-02 23:46:06 dovecot_plain authenticator failed for H=(DESKTOP-10O043O) [200.114.169.214]:50298: 535 Incorrect authentication data (set_id=angiehng@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:46:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56834: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.59
country_id: 597427
description:
2026-02-02 23:46:56 dovecot_login authenticator failed for H=(v4uXyzO) [141.98.10.59]:57086: 535 Incorrect authentication data (set_id=oxbold)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.114.175.22
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12601516692936 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:46:04 dovecot_login authenticator failed for H=(9KKJZmZVIO) [77.83.39.61]:65165: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-02-02 23:46:40 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (ounerin) [73.137.7.97]:33426: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.22
country_id: 2750405
description:
Feb  2 23:46:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account inquiries@ktlog.com.my has been temporarily locked by Imunify PAM(46.151.182.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:46:21 dovecot_login authenticator failed for H=(190NQ7) [165.154.252.84]:62169: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/asia/images/product.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: mail.autogreastar.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/autogrea/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.114.169.214
country_id: 3865483
description:
2026-02-02 23:47:08 dovecot_plain authenticator failed for H=(DESKTOP-10O043O) [200.114.169.214]:54369: 535 Incorrect authentication data (set_id=angiehng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:47:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49398: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:47:05 H=(185.93.89.63) [185.93.89.63]:55991 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <myang@tribune.com>: The mail server could not deliver mail to myang@tribune.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:47:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44766: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:47:20 dovecot_login authenticator failed for H=(2kAutaB) [77.83.39.61]:52167: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.22.232.166
country_id: 6252001
description:
2026-02-02 23:47:13 dovecot_login authenticator failed for H=([127.0.0.1]) [72.22.232.166]:51143: 535 Incorrect authentication data (set_id=063357927@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:47:18 dovecot_login authenticator failed for H=(U9awaiJ) [165.154.252.84]:57919: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/rootfiles.conf||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f5af288feed62d2a5b13982e94f87c284bd5fef8||Title:0xf5b0bc82||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:48:15 dovecot_login authenticator failed for H=(PQlV7MY) [165.154.252.84]:54981: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:48:18 dovecot_login authenticator failed for H=(mokRbpHr53) [158.94.210.42]:54731: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.114.169.214
country_id: 3865483
description:
2026-02-02 23:48:20 dovecot_plain authenticator failed for H=(DESKTOP-10O043O) [200.114.169.214]:59319: 535 Incorrect authentication data (set_id=angiehng@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:48:16 dovecot_login authenticator failed for H=(NWh2BKr3T) [77.83.39.61]:62538: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:48:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60425: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.203.114
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57001516870904 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:49:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:35816: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:49:12 dovecot_login authenticator failed for H=(48oxTI) [165.154.252.84]:53867: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.172.179
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/food-hotel.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/screen.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:49:11 dovecot_login authenticator failed for H=(MHkIQSdHU) [77.83.39.61]:64420: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:49:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55535: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:49:28 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:49:44 dovecot_login authenticator failed for H=(sPCKfmyodS) [158.94.210.42]:65285: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:49:49 dovecot_login authenticator failed for H=(CQcOlh46Jg) [77.83.39.61]:50627: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:49:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:50:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65111: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:50:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:50:18 dovecot_login authenticator failed for H=(NLGaf7d) [158.94.210.42]:57853: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-02-02 23:50:33 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:47960: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 23:50:59 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:59012: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:50:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:50:08 dovecot_login authenticator failed for H=(vZayOXChYY) [77.83.39.61]:57951: 535 Incorrect authentication data (set_id=garylee)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/modsec2.imunify.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:50:58 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:50:09 dovecot_login authenticator failed for H=(oGHQgxUA) [165.154.252.84]:52150: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:50:15 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-02-02 23:50:47 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:44650: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ed714d8cd921ffa12eb6693c0c88279200b121c1||Title:0xe90cb94b||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:51:44 H=(185.93.89.63) [185.93.89.63]:56905 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <bstoddard@lacapra.com>: The mail server could not deliver mail to bstoddard@lacapra.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:51:05 dovecot_login authenticator failed for H=(BPhXJuDCD) [77.83.39.61]:59489: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:51:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59291: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 23:51:29 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:58861: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:51:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:51:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57018: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:51:06 dovecot_login authenticator failed for H=(WcqBORAkg4) [165.154.252.84]:49901: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:51:16 dovecot_login authenticator failed for H=(Bd6wSI2TFl) [158.94.210.42]:62091: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5c8bf1b419464d1d82cc71bb296047f2a40ee304||Title:0x42510482||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:51:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/i360deploy.log||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:52:14 dovecot_login authenticator failed for H=(X6EbwsNX) [158.94.210.42]:49851: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/i360-app-based-excludes.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:52:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54705: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:52:03 dovecot_login authenticator failed for H=(DbuwCFz7) [165.154.252.84]:64596: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:52:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:52:03 dovecot_login authenticator failed for H=(Bk7EWG) [77.83.39.61]:54580: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 23:52:36 dovecot_login authenticator failed for H=(R7pua9sx5) [178.16.52.139]:61254: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:52:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:53:03 dovecot_login authenticator failed for H=(iQacws) [77.83.39.61]:51019: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 23:53:03 dovecot_login authenticator failed for H=(0i1TIygxj) [178.16.52.139]:61586: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:53:19 dovecot_login authenticator failed for H=(fkk8pYJ) [165.154.252.84]:55976: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/access_checker.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 23:53:15 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93a9fca9a26f89a30cfb6459d151fbdc06a22015||Title:0xa652c9b9||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:53:39 dovecot_login authenticator failed for H=(6SwZRlHwzC) [158.94.210.42]:57848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 165.154.252.84
country_id: 2635167
description:
Feb  2 23:53:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account juliza has been locked for the attacker IP 165.154.252.84


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:53:57 dovecot_login authenticator failed for H=(vpvVXYJ5) [165.154.252.84]:52515: 535 Incorrect authentication data (set_id=juliza)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:53:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60834: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:53:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dce3b633488038d2dc20ec8240f095c75743251c||Title:0x30bcd01b||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/autoindex.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:54:21 dovecot_login authenticator failed for H=(ZxDI78oiPq) [77.83.39.61]:63012: 535 Incorrect authentication data (set_id=garylee)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.180.34
country_id: 1835841
domain: lnlfireprotection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/lnlfireprotectio/public_html/wp-includes||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 23:54:50 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 23:54:05 dovecot_login authenticator failed for H=(Rtajqv) [178.16.52.139]:65031: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:54:16 dovecot_login authenticator failed for H=(FzVRFZb) [158.94.210.42]:55721: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:54:57 H=(185.93.89.63) [185.93.89.63]:57627 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sjacobs@stege-law.com>: The mail server could not deliver mail to sjacobs@stege-law.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:54:16 dovecot_login authenticator failed for H=(rUoAfs) [165.154.252.84]:57870: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:54:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38842: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:54:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55586: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:55:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50266: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:55:14 dovecot_login authenticator failed for H=(87w0sfx) [158.94.210.42]:55299: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.127.81
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=60 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:55:13 dovecot_login authenticator failed for H=(LFq2DRr) [165.154.252.84]:57227: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:55:18 dovecot_login authenticator failed for H=(YW7C1o) [77.83.39.61]:57501: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 23:55:06 dovecot_login authenticator failed for H=(mI2Dre) [178.16.52.139]:55826: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/ossec/contrib/ossec2mysql.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.254.55
country_id: 1269750
description:
2026-02-02 23:56:10 dovecot_login authenticator failed for H=(abts-mp-dynamic-055.254.70.182.airtelbroadband.in) [182.70.254.55]:52706: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:56:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48078: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  2 23:56:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.252.84
country_id: 2635167
description:
2026-02-02 23:56:11 dovecot_login authenticator failed for H=(k42SFL2P) [165.154.252.84]:57111: 535 Incorrect authentication data (set_id=juliza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:56:12 dovecot_login authenticator failed for H=(740nzwS) [158.94.210.42]:53923: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:56:17 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60793: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7117b8e5bebfc94abf358c84659d5277f4d4b28c||Title:0x20ad7dea||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/img/photos/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 23:56:04 dovecot_login authenticator failed for H=(iVW8539l) [178.16.52.139]:53394: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:56:16 dovecot_login authenticator failed for H=(pDec44MV1) [77.83.39.61]:61130: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-02-02 23:56:21 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:50394: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.104.12
country_id: 1880251
domain: shop.pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/m.php||SC:/home/pftfood/public_html/epft/upload/images||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 130.12.182.67
country_id: 6252001
description:
Feb  2 23:57:07 sv3 pure-ftpd[2356570]: (?@130.12.182.67) [WARNING] Authentication failed for user [airulaiddi]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:57:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55083: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 23:57:21 dovecot_login authenticator failed for H=(5kX5aj) [178.16.52.139]:54965: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:57:09 H=(185.93.89.63) [185.93.89.63]:57984 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <skoshy@mail.uch.org>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:57:13 dovecot_login authenticator failed for H=(KEI8zldJ) [158.94.210.42]:57426: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.104.12
country_id: 1880251
domain: shop.pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/pftfood/public_html/epft/upload/wp-includes||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:57:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a44e5f12923a9e005b7c7699f9ae47d3f3373822||Title:0x10c64003||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  2 23:57:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:57:14 dovecot_login authenticator failed for H=(ZMiOC9cL) [77.83.39.61]:58033: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 23:57:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@smartcable.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 23:58:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@smartcable.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 23:58:17 dovecot_login authenticator failed for H=(CrrkYaml) [178.16.52.139]:59626: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:58:31 dovecot_login authenticator failed for H=(KzUqQDQz) [77.83.39.61]:53868: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:58:12 dovecot_login authenticator failed for H=(zluUXG) [77.83.39.61]:54091: 535 Incorrect authentication data (set_id=garylee)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.212.104.12
country_id: 1880251
domain: shop.pftfood.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/pftfood/public_html/epft/upload/wp-includes||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.104.12
country_id: 1880251
domain: shop.pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/uploads/autoload_classmap.php||SC:/home/pftfood/public_html/epft/upload/uploads||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:58:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:58:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51903: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:58:20 dovecot_login authenticator failed for H=(HusuvVK) [158.94.210.42]:57531: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 23:59:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56573: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.39
country_id: 1814991
description:
2026-02-02 23:59:08 dovecot_login authenticator failed for H=([111.26.62.39]) [111.26.62.39]:54340: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 23:59:10 dovecot_login authenticator failed for H=(giu3t783) [77.83.39.61]:54041: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-02-02 23:59:41 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:40240: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 23:59:13 dovecot_login authenticator failed for H=(YKU85PjvMg) [178.16.52.139]:63293: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 23:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@smartcable.com.my has been locked for the attacker IP 178.16.52.139


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:61eb79ceab3b206b86dd79439e30d21b4e13f1f8||Title:0x7b471483||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 23:59:58 H=(185.93.89.63) [185.93.89.63]:58594 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <mwu@mail.uch.org>: host lookup did not complete


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.20
country_id: 2750405
description:
Feb  2 23:59:36 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jb-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.20)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 23:59:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54566: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 23:59:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-02 23:59:22 dovecot_login authenticator failed for H=(z6V0ho) [158.94.210.42]:49362: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2026-02-02 23:59:30 dovecot_login authenticator failed for H=(190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:45196: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:00:22 H=(185.93.89.63) [185.93.89.63]:58652 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <khogan@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:00:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62830: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  3 00:00:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.237.115.229
country_id: 1880251
description:
Feb  3 00:00:30 sv3 pure-ftpd[2359282]: (?@47.237.115.229) [INFO] New connection from 47.237.115.229


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:00:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@smartcable.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-03 00:00:08 dovecot_login authenticator failed for H=(U2gAiO) [77.83.39.61]:60987: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.14
country_id: 2750405
description:
Feb  3 00:00:24 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jb-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.14)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:00:25 dovecot_login authenticator failed for H=(0Sabo4) [178.16.52.139]:51321: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:00:24 dovecot_login authenticator failed for H=(hkU5Jax) [158.94.210.42]:64192: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ddc7c47c45ea90ffb061857674868476c69f7b5||Title:0x6376ffeb||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  3 00:01:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-03 00:01:07 dovecot_login authenticator failed for H=(7x3BzOHBZr) [77.83.39.61]:50238: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 46.151.182.22
country_id: 2750405
description:
Feb  3 00:01:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account jb-sales@mckd.com.my has been temporarily locked by Imunify PAM(46.151.182.22)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.213.132.189
country_id: 6252001
description:
[2026-02-03 00:01:11 +0800] info [whostmgrd] 72.213.132.189 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:01:28 dovecot_login authenticator failed for H=(it7dD2xYv) [158.94.210.42]:52409: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:01:39 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60758: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:01:03 dovecot_login authenticator failed for H=(cM5ciu) [178.16.52.139]:57225: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:01:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account enquiry@smartcable.com.my has been locked for the attacker IP 178.16.52.139


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-03 00:01:32 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:01:33 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58634: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:02:07 dovecot_login authenticator failed for H=(uuvCpT) [178.16.52.139]:57826: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:02:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52235: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:02:32 dovecot_login authenticator failed for H=(OEQkh5QcQ) [158.94.210.42]:61487: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-03 00:02:07 dovecot_login authenticator failed for H=(npcQkGeX) [77.83.39.61]:52683: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-03 00:02:46 dovecot_login authenticator failed for H=(TJhmhw) [77.83.39.61]:57814: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.87
country_id: 1668284
description:
2026-02-03 00:02:43 dovecot_login authenticator failed for H=111-70-9-87.emome-ip.hinet.net [111.70.9.87]:54213: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e6aff7693ba1dd8c9563a68b764666c9d74a5589||Title:0xfc7afefa||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  3 00:02:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:03:54 dovecot_login authenticator failed for H=(ZrsBWFoz) [158.94.210.42]:57236: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:03:10 dovecot_login authenticator failed for H=(BAsbvBbMe) [178.16.52.139]:59293: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.132.108.132
country_id: 6252001
domain: nexuscollection.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.71||T:APACHE||REQUEST_URI:/sito/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:03:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63285: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/imunify360-webshield/captcha/babel.cfg||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:03:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.151.13.55
country_id: 1814991
description:
2026-02-03 00:03:04 dovecot_login authenticator failed for H=([27.151.13.55]) [27.151.13.55]:51612: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-03 00:03:04 dovecot_login authenticator failed for H=(QiIY3ShkCR) [77.83.39.61]:54960: 535 Incorrect authentication data (set_id=garylee)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.82.238.96
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=123963 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:04:18 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53152: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 104.28.244.126
country_id: 1168579
domain: tujusetia.my
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.71||T:APACHE||SC:/home/tuju7822/public_html/wp-admin/admin-ajax.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:04:09 dovecot_login authenticator failed for H=(NaE53D36) [178.16.52.139]:58913: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.94.35.104
country_id: 3469034
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:meraakistudio_jzp165vn.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:541db7baf8c12371364922f9b484468df706ac4d||Title:0x3287d507||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dnf/plugins/debuginfo-install.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:04:19 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57284: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-03 00:04:20 dovecot_login authenticator failed for H=(1J2QBymdnZ) [77.83.39.61]:53227: 535 Incorrect authentication data (set_id=garylee)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 104.28.244.126
country_id: 1168579
domain: tujusetia.my
description:
IM360 WAF: PHP Injection Low value||MV:phpinfo();die();||MVN:ARGS:callback[args][]||RSV:7.71||T:APACHE||SC:/home/tuju7822/public_html/wp-admin/admin-ajax.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:04:23 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:04:25 dovecot_login authenticator failed for H=(GWmpg16Q) [158.94.210.42]:58433: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:05:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50727: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:05:12 dovecot_login authenticator failed for H=(MbJyJw) [178.16.52.139]:64562: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  3 00:05:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account garylee has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-03 00:05:17 dovecot_login authenticator failed for H=(8rStLz) [77.83.39.61]:63626: 535 Incorrect authentication data (set_id=garylee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:06:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60648: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/imunify-agent-proxy.log||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 00:06:44 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:54395: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:06:03 dovecot_login authenticator failed for H=(oYfDKp18) [178.16.52.139]:55846: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:06:18 dovecot_login authenticator failed for H=(8W0ifv) [158.94.210.42]:49461: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:06:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59590: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:06:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:06:21 dovecot_login authenticator failed for H=(oEOsXvszea) [178.16.52.139]:49550: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.59.70
country_id: 2017370
description:
2026-02-03 00:06:55 dovecot_login authenticator failed for H=([90.188.59.70]) [90.188.59.70]:37371: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:07:03 dovecot_login authenticator failed for H=(BweqKlv) [178.16.52.139]:52686: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.217
country_id: 1668284
description:
2026-02-03 00:07:09 dovecot_login authenticator failed for H=111-70-39-217.emome-ip.hinet.net [111.70.39.217]:40749: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:07:18 H=(185.93.89.63) [185.93.89.63]:60020 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <robert.schoepf@uff.us>: The mail server could not deliver mail to robert.schoepf@uff.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-02-03 00:07:20 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com [95.155.228.189]:51211: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-02-03 00:07:06 dovecot_login authenticator failed for H=([120.29.140.188]) [120.29.140.188]:34084: 535 Incorrect authentication data (set_id=postmaster@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-02-03 00:07:07 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (oless) [73.144.27.228]:60070: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:07:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53649: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:07:11 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/exim.key||User:mailnull||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:07:23 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:07:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.51.82
country_id: 1269750
description:
2026-02-03 00:07:43 dovecot_login authenticator failed for H=([182.79.51.82]) [182.79.51.82]:46578: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-02-03 00:07:18 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:48653: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:07:15 dovecot_login authenticator failed for H=(Oqno0hNe) [158.94.210.42]:61213: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.112.39
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76061516779455 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:08:26 dovecot_login authenticator failed for H=(d4SgCG1) [178.16.52.139]:60665: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:08:29 H=(185.93.89.63) [185.93.89.63]:60333 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <pault@orchidinternational.com>: The mail server could not deliver mail to pault@orchidinternational.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:08:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63407: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:08:22 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:08:03 dovecot_login authenticator failed for H=(MFULML) [178.16.52.139]:49912: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:08:14 dovecot_login authenticator failed for H=(LzrFeC) [158.94.210.42]:54819: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/exim.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:09:06 dovecot_login authenticator failed for H=(bdpJtZXCt1) [158.94.210.42]:51098: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:09:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:36400: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:09:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61295: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/chrony.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:09:19 dovecot_login authenticator failed for H=(3hluy3Jwb) [178.16.52.139]:53608: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/dracut/dracut.conf.d/01-dist.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.111.141
country_id: 1861060
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/mschemic/public_html/wp-admin/images/commentv.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-02-03 00:10:22 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:53623: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:10:24 H=(185.93.89.63) [185.93.89.63]:60646 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sheila.james-hamler@frcnet.com>: The mail server could not deliver mail to sheila.james-hamler@frcnet.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.173.227
country_id: 2017370
description:
2026-02-03 00:10:30 dovecot_login authenticator failed for H=([109.202.173.227]) [109.202.173.227]:49026: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-02-03 00:10:40 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:55632: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:10:59 dovecot_login authenticator failed for H=(ZEHvXJC) [178.16.52.139]:59393: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:10:14 dovecot_login authenticator failed for H=(SsEuRbJ6) [178.16.52.139]:49812: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:10:51 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:11:01 dovecot_login authenticator failed for H=(ujzm2yQdY) [158.94.210.42]:52910: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:10:10 dovecot_login authenticator failed for H=(1a5Sn2EkZ) [141.98.11.82]:61631: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:10:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55660: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2026-02-03 00:10:32 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:28743: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:11:40 dovecot_login authenticator failed for H=(vlQDop) [141.98.11.82]:53946: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:11:13 H=(185.93.89.63) [185.93.89.63]:60788 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <drambo@fs.fed.us>: The mail server could not deliver mail to drambo@fs.fed.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:11:19 dovecot_login authenticator failed for H=(S6wSp7b4i) [178.16.52.139]:56524: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:12:02 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:40840: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:11:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50161: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home5/manfotp3/ssl/ssl.db||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:11:27 dovecot_login authenticator failed for H=(JSCLaS8d) [158.94.210.42]:63760: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:12:43 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:12:22 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:12:23 dovecot_login authenticator failed for H=(vEfHiQPayJ) [178.16.52.139]:65206: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-02-03 00:12:44 dovecot_login authenticator failed for H=([36.39.140.2]) [36.39.140.2]:44836: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:12:36 dovecot_login authenticator failed for H=(CXbwwcFB) [141.98.11.82]:55924: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:12:27 dovecot_login authenticator failed for H=(b4Iyd4K0) [158.94.210.42]:57400: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:12:45 dovecot_login authenticator failed for H=(5EUoB5P) [178.16.52.139]:64073: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:12:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61329: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.189.191
country_id: 2017370
description:
2026-02-03 00:12:53 dovecot_login authenticator failed for H=([46.163.189.191]) [46.163.189.191]:45290: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:12:24 H=(185.93.89.63) [185.93.89.63]:61039 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <diane@pwrr.com>: The mail server could not deliver mail to diane@pwrr.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:13:56 H=(185.93.89.63) [185.93.89.63]:61450 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <karmen@karmensorenson.com>: The mail server could not deliver mail to karmen@karmensorenson.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:13:01 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55365: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:13:15 dovecot_login authenticator failed for H=(fZTa8yASG) [141.98.11.82]:63575: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:13:25 dovecot_login authenticator failed for H=(vDS37erS) [158.94.210.42]:53809: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:13:04 dovecot_login authenticator failed for H=(lK9eVl) [178.16.52.139]:64020: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home4/manfotp3/mail/dovecot.mailbox.log||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:14:19 dovecot_login authenticator failed for H=(hrjV5XoJXP) [158.94.210.42]:56028: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/crypto-policies/local.d/nss-p11-kit.config||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 191.104.6.219
country_id: 3686110
domain: thinkcloud.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:64925.thinkcloud.com.my||ServerName:thinkcloud.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b7a35675eccace90a3e4c66f82b8241695e87806||Title:0xb22ecf51||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:14:16 dovecot_login authenticator failed for H=(WpLrKdSpei) [141.98.11.82]:57012: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:14:17 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:14:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58799: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:14:59 dovecot_login authenticator failed for H=(MIEJ4uownA) [178.16.52.139]:52497: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:14:18 dovecot_login authenticator failed for H=(PUywaY4h) [178.16.52.139]:59941: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:14:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38186: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:14:42 H=(185.93.89.63) [185.93.89.63]:61569 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <georgetbell@century21bell.com>: The mail server could not deliver mail to georgetbell@century21bell.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.181.7
country_id: 1814991
description:
2026-02-03 00:15:06 dovecot_login authenticator failed for H=([61.145.181.7]) [61.145.181.7]:48365: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-03 00:15:23 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:42874: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:15:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:15:12 dovecot_login authenticator failed for H=(yr1hvEvqi) [158.94.210.42]:58510: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:15:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52488: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:15:47 dovecot_login authenticator failed for H=(qW8Mtvs) [141.98.11.82]:57768: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:15:03 dovecot_login authenticator failed for H=(H3jEDk7Q9c) [178.16.52.139]:59332: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/manfotp3/etc/manfotp3.rcube.db||User:manfotp3||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-02-03 00:15:22 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:43009: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:15:50 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-02-03 00:17:01 dovecot_login authenticator failed for H=([211.53.58.1]) [211.169.212.206]:63638: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:16:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:16:04 dovecot_login authenticator failed for H=(GRWXHX6) [158.94.210.42]:52888: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:16:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62660: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:16:13 dovecot_login authenticator failed for H=(h0y6iZ77) [141.98.11.82]:51113: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:16:33 dovecot_login authenticator failed for H=(J8noMk6hB) [178.16.52.139]:61545: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:16:03 dovecot_login authenticator failed for H=(AAkoD2D) [178.16.52.139]:65353: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/mail/dovecot.list.index.log||User:pftfood||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:17:02 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57537: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.51.82
country_id: 1269750
description:
2026-02-03 00:17:09 dovecot_login authenticator failed for H=([182.79.51.82]) [182.79.51.82]:37674: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/asia/images/tyresafetytips.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:17:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:17:41 dovecot_login authenticator failed for H=(cHIAx8Z2R9) [158.94.210.42]:49866: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:17:04 dovecot_login authenticator failed for H=(5JSDkuBJwV) [178.16.52.139]:61680: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:17:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34514: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:17:23 dovecot_login authenticator failed for H=(yEcno5stfw) [141.98.11.82]:64097: 535 Incorrect authentication data (set_id=wilson)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/61-urw-z003.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.51.49.90
country_id: 3508796
description:
2026-02-03 00:17:35 dovecot_plain authenticator failed for H=(acism) [38.51.49.90]:59561: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:18:12 H=(185.93.89.63) [185.93.89.63]:62257 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <larry@hoffroggedevelopment.net>: The mail server could not deliver mail to larry@hoffroggedevelopment.net.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/61-urw-standard-symbols-ps.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 00:18:18 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:64857: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:18:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:18:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51945: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:18:06 dovecot_login authenticator failed for H=(JZg7D1Cx) [158.94.210.42]:53401: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:18:08 dovecot_login authenticator failed for H=(NuCI0I3pm) [178.16.52.139]:49951: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:18:13 dovecot_login authenticator failed for H=(0zdtNqzKSg) [141.98.11.82]:62808: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-02-03 00:19:56 dovecot_login authenticator failed for H=([123.212.9.122]) [123.212.9.122]:58456: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:19:07 dovecot_login authenticator failed for H=(ESpwIYg5) [178.16.52.139]:53987: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/tmp/awstats/awstats.pftfood.com.conf||User:pftfood||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:19:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:19:22 dovecot_login authenticator failed for H=(ZRVaHRe3nh) [158.94.210.42]:55566: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:19:02 dovecot_login authenticator failed for H=(LzHYc72zKP) [141.98.11.82]:58568: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:19:14 dovecot_login authenticator failed for H=(NHKdmiTZ) [178.16.52.139]:49411: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:19:24 H=(185.93.89.63) [185.93.89.63]:62494 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jarmstrong@vsp.state.va.us>: The mail server could not deliver mail to jarmstrong@vsp.state.va.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:19:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58460: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:19:40 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:19:46 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37456: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/ai-bolit/ai-bolit-hoster-full.cache.db||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:20:40 dovecot_login authenticator failed for H=(N3wDRmLT) [158.94.210.42]:57788: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-02-03 00:20:12 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52316: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:20:15 dovecot_login authenticator failed for H=(m02m4Mhiq5) [178.16.52.139]:51874: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:20:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53013: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:20:38 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:20:44 dovecot_login authenticator failed for H=(x8UPJLZrAg) [141.98.11.82]:60579: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/ai-bolit/mds-ai-bolit-hoster.db||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:21:09 dovecot_login authenticator failed for H=(YS4RDCrR9f) [141.98.11.82]:62817: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:21:02 dovecot_login authenticator failed for H=(VdRRHdIyz) [178.16.52.139]:51628: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:21:21 dovecot_login authenticator failed for H=(lS0JrEBQl) [178.16.52.139]:64038: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:21:22 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62960: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:21:32 dovecot_login authenticator failed for H=(OeJ6bm) [158.94.210.42]:62837: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:21:35 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:22:04 dovecot_login authenticator failed for H=(nUzY54e) [178.16.52.139]:55414: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:22:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58278: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:22:22 dovecot_login authenticator failed for H=(0imasx) [158.94.210.42]:51871: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:22:24 dovecot_login authenticator failed for H=(1UhaR6yr) [141.98.11.82]:58991: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:22:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42612: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:23:09 dovecot_login authenticator failed for H=(025elBahE) [178.16.52.139]:55918: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:23:11 dovecot_login authenticator failed for H=(O9sPcrt) [141.98.11.82]:61996: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:23:15 dovecot_login authenticator failed for H=(sYG9QIfm) [158.94.210.42]:57291: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:23:29 dovecot_login authenticator failed for H=(WZ5O3F) [178.16.52.139]:55147: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:23:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58540: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:24:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52201: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:24:12 dovecot_login authenticator failed for H=(yMUo4U4Abz) [178.16.52.139]:50930: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:24:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:24:51 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-02-03 00:24:56 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:34660: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:24:05 dovecot_login authenticator failed for H=(MeHjZj) [141.98.11.82]:56862: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:24:06 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:24:10 dovecot_login authenticator failed for H=(UdXO3C) [158.94.210.42]:57613: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.61.48.234
country_id: 1835841
description:
2026-02-03 00:24:45 dovecot_login authenticator failed for H=([125.61.36.27]) [125.61.48.234]:60006: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:25:07 dovecot_login authenticator failed for H=(e8Io7q6P) [178.16.52.139]:52390: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:25:48 dovecot_login authenticator failed for H=(5POAnSd1) [141.98.11.82]:53637: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:25:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62761: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.182.49
country_id: 6252001
description:
2026-02-03 00:25:18 dovecot_login authenticator failed for H=(localhost) [130.12.182.49]:63889: 535 Incorrect authentication data (set_id=guest)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-02-03 00:25:21 H=([77.83.39.167]) [77.83.39.167]:59518 F=<stevenwelboun@op.pl> rejected RCPT <fkr@fkr.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:25:31 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2026-02-03 00:25:11 dovecot_login authenticator failed for H=(nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:40118: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:25:15 dovecot_login authenticator failed for H=(7bAHeCf) [178.16.52.139]:50159: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:25:32 dovecot_login authenticator failed for H=(zhS6NPBOq) [158.94.210.42]:63697: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:25:59 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:25:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42290: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.103.66
country_id: 1835841
description:
2026-02-03 00:25:23 dovecot_login authenticator failed for H=([175.205.103.66]) [175.205.103.66]:48931: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-02-03 00:25:42 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:59928: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-02-03 00:25:56 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:39646: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:26:40 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-02-03 00:27:02 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com ([127.0.0.1]) [31.208.108.219]:55360: 535 Incorrect authentication data (set_id=htayhtay)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:26:37 dovecot_login authenticator failed for H=(Vpmc7I) [141.98.11.82]:51670: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:26:02 dovecot_login authenticator failed for H=(4T9FQkA) [178.16.52.139]:56702: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:26:02 dovecot_login authenticator failed for H=(AyR4TcpmD5) [158.94.210.42]:53842: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-02-03 00:26:51 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:54594: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.220.247.157
country_id: 6252001
description:
2026-02-03 00:26:55 dovecot_login authenticator failed for H=([127.0.0.1]) [104.220.247.157]:47414: 535 Incorrect authentication data (set_id=htayhtay@manforce.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:26:57 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:26:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57728: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:27:34 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:27:54 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57196: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:27:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:27:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:27:27 dovecot_login authenticator failed for H=(hH8Lsyleh) [158.94.210.42]:52170: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:27:43 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60821: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:27:03 dovecot_login authenticator failed for H=(PhOYSFO0eY) [178.16.52.139]:63050: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:27:11 dovecot_login authenticator failed for H=(DlegU6Z) [178.16.52.139]:49639: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-03 00:27:37 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:60302: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:28:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:28:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60821: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-02-03 00:28:13 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:59562: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-02-03 00:28:21 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:48692: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:28:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account cky@ahfengineering.com has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:28:20 dovecot_login authenticator failed for H=(LCvXIXJ) [158.94.210.42]:52179: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:28:21 dovecot_login authenticator failed for H=(96Cenn24TA) [141.98.11.82]:49246: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:28:09 dovecot_login authenticator failed for H=(b9wxEY178M) [178.16.52.139]:61093: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:29:41 dovecot_login authenticator failed for H=(YUup5JbH4A) [158.94.210.42]:55141: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:29:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2026-02-03 00:29:15 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (cayogral) [24.91.103.202]:51618: 535 Incorrect authentication data (set_id=admin@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:29:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54908: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.30.125.75
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=498542 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.130.47.57
country_id: 6252001
description:
2026-02-03 00:30:01 dovecot_login authenticator failed for H=(localhost.localdomain) [178.130.47.57]:63154: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:29:08 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:29:14 dovecot_login authenticator failed for H=(nCJpbrV) [178.16.52.139]:50599: 535 Incorrect authentication data (set_id=enquiry@smartcable.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:29:35 dovecot_login authenticator failed for H=(nUHnJ4) [178.16.52.139]:58642: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:29:40 dovecot_login authenticator failed for H=(NaYrIYl) [141.98.11.82]:54721: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:29:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:30:38 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:30:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50088: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:30:04 dovecot_login authenticator failed for H=(f1BsWE) [141.98.11.82]:62691: 535 Incorrect authentication data (set_id=wilson@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 64.89.161.101
country_id: 2635167
description:
Feb  3 00:30:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account career@symphony-led.com has been temporarily locked by Imunify PAM(64.89.161.101)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:30:40 dovecot_login authenticator failed for H=(yTNtQIMkT) [158.94.210.42]:52615: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:30:44 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:30:04 dovecot_login authenticator failed for H=(waR1bzRLK) [178.16.52.139]:63870: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:30:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63254: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:31:07 dovecot_login authenticator failed for H=(iTuGxsNg) [158.94.210.42]:59629: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:31:49 dovecot_login authenticator failed for H=(5Fwy6J) [178.16.52.139]:60688: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-03 00:32:01 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:64791: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:31:03 dovecot_login authenticator failed for H=(aNvIyIy03) [178.16.52.139]:61688: 535 Incorrect authentication data (set_id=ajpsales@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:31:06 H=(185.93.89.63) [185.93.89.63]:64734 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <dwilley@diversifiedfluids.com>: The mail server could not deliver mail to dwilley@diversifiedfluids.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:31:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63959: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:31:30 dovecot_login authenticator failed for H=(hUbDUKX) [141.98.11.82]:55739: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 158.94.210.42
country_id: 2750405
description:
Feb  3 00:31:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 158.94.210.42


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  3 00:32:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account enquiry@smartcable.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:32:38 dovecot_login authenticator failed for H=(BsHM8fVeHs) [158.94.210.42]:59006: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-03 00:32:10 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.63.197
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=90111514527491 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:32:13 dovecot_login authenticator failed for H=(PKYVijz76) [178.16.52.139]:61956: 535 Incorrect authentication data (set_id=cky@ahfengineering.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:32:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50958: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.143
country_id: 2635167
description:
2026-02-03  0:32:43 326878 [Warning] Aborted connection 326878 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.143' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:32:04 dovecot_login authenticator failed for H=(aSrI4uZ) [141.98.11.82]:52979: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:33:15 dovecot_login authenticator failed for H=(BVaQAr13) [178.16.52.139]:65375: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:33:26 dovecot_login authenticator failed for H=(ve2yIJQyy) [141.98.11.82]:57635: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:33:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62880: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:33:07 dovecot_login authenticator failed for H=(odAt1EnGl) [158.94.210.42]:64718: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:34:01 dovecot_login authenticator failed for H=(iTvTcOH6xl) [178.16.52.139]:56311: 535 Incorrect authentication data (set_id=sales@figofoods.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-03 00:33:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34120: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:33:56 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.210.42
country_id: 2750405
description:
2026-02-03 00:34:06 dovecot_login authenticator failed for H=(jPNGFV) [158.94.210.42]:55431: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-03 00:34:53 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.82
country_id: 597427
description:
2026-02-03 00:34:07 dovecot_login authenticator failed for H=(p6IEDl2Y) [141.98.11.82]:51243: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.111.37.211
country_id: 6252001
description:
2026-02-03 00:34:07 dovecot_login authenticator failed for H=wsip-68-111-37-211.sb.sd.cox.net ([127.0.0.1]) [68.111.37.211]:54829: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.218.74
country_id: 174982
description:
2026-02-03 00:34:18 dovecot_login authenticator failed for H=([127.0.0.1]) [37.157.218.74]:54146: 535 Incorrect authentication data (set_id=rina)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-03 00:34:36 H=(185.93.89.63) [185.93.89.63]:65475 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <wsmolucha@wms.com>: The mail server could not deliver mail to wsmolucha@wms.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-03 00:34:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58414: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-03 00:34:06 dovecot_login authenticator failed for H=(SYm1uag1) [178.16.52.139]:57605: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.158.121.26
country_id: 1643084
domain: 42.0.28.25
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.bak||User:tuju7822||


